Update

Added some error logging

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# These are supported funding model platforms
+
+github: PrzemyslawKlys
+custom: https://paypal.me/PrzemyslawKlys

Docs/Backup-GPOZaurr.md

@@ -0,0 +1,214 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Backup-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Backup-GPOZaurr [[-LimitProcessing] <Int32>] [[-Type] <String[]>] [[-Forest] <String>]
+ [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>]
+ [[-GPOPath] <String[]>] [[-BackupPath] <String>] [-BackupDated] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupDated
+{{ Fill BackupDated Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -BackupPath
+{{ Fill BackupPath Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 7
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -LimitProcessing
+{{ Fill LimitProcessing Description }}
+
+```yaml
+Type: Int32
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: All, Empty, Unlinked
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurr.md

@@ -0,0 +1,197 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurr [[-GPOName] <String>] [[-GPOGuid] <String>] [[-Forest] <String>] [[-ExcludeDomains] <String[]>]
+ [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>] [[-GPOPath] <String[]>]
+ [-PermissionsOnly] [-OwnerOnly] [-Limited] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOGuid
+{{ Fill GPOGuid Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: GUID, GPOID
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOName
+{{ Fill GPOName Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Limited
+{{ Fill Limited Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -OwnerOnly
+{{ Fill OwnerOnly Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -PermissionsOnly
+{{ Fill PermissionsOnly Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrBackupInformation.md

@@ -0,0 +1,60 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrBackupInformation
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrBackupInformation [[-BackupFolder] <String[]>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupFolder
+{{ Fill BackupFolder Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrLink.md

@@ -0,0 +1,152 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrLink
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrLink [[-ADObject] <ADObject[]>] [-Limited] [[-GPOCache] <IDictionary>] [[-Forest] <String>]
+ [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>]
+ [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ADObject
+{{ Fill ADObject Description }}
+
+```yaml
+Type: ADObject[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: True (ByPropertyName, ByValue)
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOCache
+{{ Fill GPOCache Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Limited
+{{ Fill Limited Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### Microsoft.ActiveDirectory.Management.ADObject[]
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrPassword.md

@@ -0,0 +1,121 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrPassword
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrPassword [[-Forest] <String>] [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>]
+ [[-ExtendedForestInformation] <IDictionary>] [[-GPOPath] <String[]>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrPermission.md

@@ -0,0 +1,280 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrPermission
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+### GPO (Default)
+```
+Get-GPOZaurrPermission [-Type <String[]>] [-SkipWellKnown] [-SkipAdministrative] [-ResolveAccounts]
+ [-IncludeOwner] [-IncludePermissionType <GPPermissionType[]>] [-ExcludePermissionType <GPPermissionType[]>]
+ [-IncludeGPOObject] [-Forest <String>] [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>]
+ [-ExtendedForestInformation <IDictionary>] [<CommonParameters>]
+```
+
+### GPOName
+```
+Get-GPOZaurrPermission [-GPOName <String>] [-Type <String[]>] [-SkipWellKnown] [-SkipAdministrative]
+ [-ResolveAccounts] [-IncludeOwner] [-IncludePermissionType <GPPermissionType[]>]
+ [-ExcludePermissionType <GPPermissionType[]>] [-IncludeGPOObject] [-Forest <String>]
+ [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>] [-ExtendedForestInformation <IDictionary>]
+ [<CommonParameters>]
+```
+
+### GPOGUID
+```
+Get-GPOZaurrPermission [-GPOGuid <String>] [-Type <String[]>] [-SkipWellKnown] [-SkipAdministrative]
+ [-ResolveAccounts] [-IncludeOwner] [-IncludePermissionType <GPPermissionType[]>]
+ [-ExcludePermissionType <GPPermissionType[]>] [-IncludeGPOObject] [-Forest <String>]
+ [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>] [-ExtendedForestInformation <IDictionary>]
+ [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludePermissionType
+{{ Fill ExcludePermissionType Description }}
+
+```yaml
+Type: GPPermissionType[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: None, GpoApply, GpoRead, GpoEdit, GpoEditDeleteModifySecurity, GpoCustom, WmiFilterEdit, WmiFilterFullControl, WmiFilterCustom, StarterGpoRead, StarterGpoEdit, StarterGpoFullControl, StarterGpoCustom, SomCreateWmiFilter, SomWmiFilterFullControl, SomCreateGpo, SomCreateStarterGpo, SomLogging, SomPlanning, SomLink
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOGuid
+{{ Fill GPOGuid Description }}
+
+```yaml
+Type: String
+Parameter Sets: GPOGUID
+Aliases: GUID, GPOID
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOName
+{{ Fill GPOName Description }}
+
+```yaml
+Type: String
+Parameter Sets: GPOName
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeGPOObject
+{{ Fill IncludeGPOObject Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeOwner
+{{ Fill IncludeOwner Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludePermissionType
+{{ Fill IncludePermissionType Description }}
+
+```yaml
+Type: GPPermissionType[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: None, GpoApply, GpoRead, GpoEdit, GpoEditDeleteModifySecurity, GpoCustom, WmiFilterEdit, WmiFilterFullControl, WmiFilterCustom, StarterGpoRead, StarterGpoEdit, StarterGpoFullControl, StarterGpoCustom, SomCreateWmiFilter, SomWmiFilterFullControl, SomCreateGpo, SomCreateStarterGpo, SomLogging, SomPlanning, SomLink
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ResolveAccounts
+{{ Fill ResolveAccounts Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipAdministrative
+{{ Fill SkipAdministrative Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipWellKnown
+{{ Fill SkipWellKnown Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: Unknown, All
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Get-GPOZaurrWMI.md

@@ -0,0 +1,136 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Get-GPOZaurrWMI
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Get-GPOZaurrWMI [[-Guid] <Guid[]>] [[-Name] <String[]>] [[-Forest] <String>] [[-ExcludeDomains] <String[]>]
+ [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Guid
+{{ Fill Guid Description }}
+
+```yaml
+Type: Guid[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Name
+{{ Fill Name Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/New-GPOZaurrWMI.md

@@ -0,0 +1,213 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# New-GPOZaurrWMI
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+New-GPOZaurrWMI [-Name] <String> [[-Description] <String>] [-Query] <String> [-SkipQueryCheck] [-Force]
+ [[-Forest] <String>] [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>]
+ [[-ExtendedForestInformation] <IDictionary>] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Description
+{{ Fill Description Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Force
+{{ Fill Force Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Name
+{{ Fill Name Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: True
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Query
+{{ Fill Query Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: True
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipQueryCheck
+{{ Fill SkipQueryCheck Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Readme.md

@@ -0,0 +1,52 @@
+---
+Module Name: GPOZaurr
+Module Guid: f7d4c9e4-0298-4f51-ad77-e8e3febebbde
+Download Help Link: {{ Update Download Link }}
+Help Version: {{ Please enter version of help manually (X.X.X.X) format }}
+Locale: en-US
+---
+
+# GPOZaurr Module
+## Description
+{{ Fill in the Description }}
+
+## GPOZaurr Cmdlets
+### [Backup-GPOZaurr](Backup-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurr](Get-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrBackupInformation](Get-GPOZaurrBackupInformation.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrLink](Get-GPOZaurrLink.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrPassword](Get-GPOZaurrPassword.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrPermission](Get-GPOZaurrPermission.md)
+{{ Fill in the Description }}
+
+### [Get-GPOZaurrWMI](Get-GPOZaurrWMI.md)
+{{ Fill in the Description }}
+
+### [New-GPOZaurrWMI](New-GPOZaurrWMI.md)
+{{ Fill in the Description }}
+
+### [Remove-GPOZaurr](Remove-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Remove-GPOZaurrWMI](Remove-GPOZaurrWMI.md)
+{{ Fill in the Description }}
+
+### [Restore-GPOZaurr](Restore-GPOZaurr.md)
+{{ Fill in the Description }}
+
+### [Save-GPOZaurrFiles](Save-GPOZaurrFiles.md)
+{{ Fill in the Description }}
+
+### [Set-GPOZaurrOwner](Set-GPOZaurrOwner.md)
+{{ Fill in the Description }}
+

Docs/Remove-GPOZaurr.md

@@ -0,0 +1,214 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Remove-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Remove-GPOZaurr [-Type] <String[]> [[-LimitProcessing] <Int32>] [[-Forest] <String>]
+ [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>]
+ [[-GPOPath] <String[]>] [[-BackupPath] <String>] [-BackupDated] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupDated
+{{ Fill BackupDated Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -BackupPath
+{{ Fill BackupPath Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 7
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 6
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -LimitProcessing
+{{ Fill LimitProcessing Description }}
+
+```yaml
+Type: Int32
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+Accepted values: Empty, Unlinked
+
+Required: True
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Remove-GPOZaurrWMI.md

@@ -0,0 +1,168 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Remove-GPOZaurrWMI
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Remove-GPOZaurrWMI [[-Guid] <Guid[]>] [[-Name] <String[]>] [[-Forest] <String>] [[-ExcludeDomains] <String[]>]
+ [[-IncludeDomains] <String[]>] [[-ExtendedForestInformation] <IDictionary>] [-WhatIf] [-Confirm]
+ [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 5
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Guid
+{{ Fill Guid Description }}
+
+```yaml
+Type: Guid[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Name
+{{ Fill Name Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Restore-GPOZaurr.md

@@ -0,0 +1,121 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Restore-GPOZaurr
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Restore-GPOZaurr [-BackupFolder] <String> [[-DisplayName] <String>] [[-NewDisplayName] <String>]
+ [[-Domain] <String>] [-SkipBackupSummary] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -BackupFolder
+{{ Fill BackupFolder Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: True
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -DisplayName
+{{ Fill DisplayName Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: Name
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Domain
+{{ Fill Domain Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -NewDisplayName
+{{ Fill NewDisplayName Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -SkipBackupSummary
+{{ Fill SkipBackupSummary Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Save-GPOZaurrFiles.md

@@ -0,0 +1,136 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Save-GPOZaurrFiles
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+```
+Save-GPOZaurrFiles [[-Forest] <String>] [[-ExcludeDomains] <String[]>] [[-IncludeDomains] <String[]>]
+ [[-ExtendedForestInformation] <IDictionary>] [[-GPOPath] <String[]>] [-DeleteExisting] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -DeleteExisting
+{{ Fill DeleteExisting Description }}
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 1
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 3
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: 0
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOPath
+{{ Fill GPOPath Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: 4
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: 2
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Docs/Set-GPOZaurrOwner.md

@@ -0,0 +1,222 @@
+---
+external help file: GPOZaurr-help.xml
+Module Name: GPoZaurr
+online version:
+schema: 2.0.0
+---
+
+# Set-GPOZaurrOwner
+
+## SYNOPSIS
+{{ Fill in the Synopsis }}
+
+## SYNTAX
+
+### Type (Default)
+```
+Set-GPOZaurrOwner -Type <String[]> [-Forest <String>] [-ExcludeDomains <String[]>] [-IncludeDomains <String[]>]
+ [-ExtendedForestInformation <IDictionary>] [-LimitProcessing <Int32>] [-WhatIf] [-Confirm]
+ [<CommonParameters>]
+```
+
+### Named
+```
+Set-GPOZaurrOwner [-GPOName <String>] [-GPOGuid <String>] [-Forest <String>] [-ExcludeDomains <String[]>]
+ [-IncludeDomains <String[]>] [-ExtendedForestInformation <IDictionary>] -Principal <String>
+ [-LimitProcessing <Int32>] [-WhatIf] [-Confirm] [<CommonParameters>]
+```
+
+## DESCRIPTION
+{{ Fill in the Description }}
+
+## EXAMPLES
+
+### Example 1
+```powershell
+PS C:\> {{ Add example code here }}
+```
+
+{{ Add example description here }}
+
+## PARAMETERS
+
+### -Confirm
+Prompts you for confirmation before running the cmdlet.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: cf
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExcludeDomains
+{{ Fill ExcludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -ExtendedForestInformation
+{{ Fill ExtendedForestInformation Description }}
+
+```yaml
+Type: IDictionary
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Forest
+{{ Fill Forest Description }}
+
+```yaml
+Type: String
+Parameter Sets: (All)
+Aliases: ForestName
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOGuid
+{{ Fill GPOGuid Description }}
+
+```yaml
+Type: String
+Parameter Sets: Named
+Aliases: GUID, GPOID
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -GPOName
+{{ Fill GPOName Description }}
+
+```yaml
+Type: String
+Parameter Sets: Named
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -IncludeDomains
+{{ Fill IncludeDomains Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: (All)
+Aliases: Domain, Domains
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -LimitProcessing
+{{ Fill LimitProcessing Description }}
+
+```yaml
+Type: Int32
+Parameter Sets: (All)
+Aliases:
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Principal
+{{ Fill Principal Description }}
+
+```yaml
+Type: String
+Parameter Sets: Named
+Aliases:
+
+Required: True
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -Type
+{{ Fill Type Description }}
+
+```yaml
+Type: String[]
+Parameter Sets: Type
+Aliases:
+Accepted values: EmptyOrUnknown, NotAdministrative
+
+Required: True
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### -WhatIf
+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.
+
+```yaml
+Type: SwitchParameter
+Parameter Sets: (All)
+Aliases: wi
+
+Required: False
+Position: Named
+Default value: None
+Accept pipeline input: False
+Accept wildcard characters: False
+```
+
+### CommonParameters
+This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).
+
+## INPUTS
+
+### None
+
+## OUTPUTS
+
+### System.Object
+## NOTES
+
+## RELATED LINKS

Examples/Example-02-RemoveEmptyAndUnlinkedGPOs.ps1

@@ -2,4 +2,4 @@
 
 # Remove GPOS
 $BackupPath = "$Env:UserProfile\Desktop\GPO"
-Remove-GPOZaurr -Type Empty -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose
+Remove-GPOZaurr -Type Empty, Unlinked -BackupPath $BackupPath -BackupDated -LimitProcessing 2 -Verbose

Examples/Example-03-RestoreGPO.ps1

@@ -1,6 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-12_10_11_24'
+$RestoreFrom = 'C:\Users\przemyslaw.klys\Desktop\GPO\2020-04-26_10_29_34'
 
 $BackupInformation = Get-GPOZaurrBackupInformation -BackupFolder $RestoreFrom
 $BackupInformation | Format-Table -a

Examples/Example-04-GPOinformation.ps1

@@ -9,4 +9,4 @@ $GPOs[0].ACL | Format-Table -AutoSize
 
 $GPOs.Links | Format-Table -AutoSize
 
-$GPOS | Format-Table -AutoSize Name, WmiFilter, WMIDescription
+$GPOS | Format-Table -AutoSize DisplayName, WmiFilter, WMIDescription

Examples/Example-05-ListingWMIFiltersByName.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrWMI -Name 'Test - Dual Filter' | Format-Table -AutoSize *

Examples/Example-08-ListingPermissions.ps1

@@ -2,6 +2,6 @@
 
 $T = Get-GPOZaurrPermission -GPOName 'DC | PowerShell Logging' -Type Unknown
 
-#$T = Get-GPOZaurrPermission #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
+#$T = Get-GPOZaurrPermission -ResolveAccounts -IncludeOwner #-ExcludePermissionType GpoRead,GpoApply #-Type All #-SkipWellKnown -SkipAdministrative # -ExcludePermissionType GpoRead,GpoApply #| Out-HtmlView
 $T | Format-Table -AutoSize *
 #$T | Out-HtmlView -ScrollX -Filtering -Online -DisablePaging

Examples/Example-08-ListingPermissionsAdministrative.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -GPOName 'Default Domain Policy' -Type 'All'
+$T | Format-Table *

Examples/Example-08-ListingPermissionsPerGPO.ps1

@@ -0,0 +1,12 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' #-Principal 'marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'EVOTEC\marikegerard' -PrincipalType Name # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'S-1-5-18' -PrincipalType Sid # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'CN=Enterprise Admins,CN=Users,DC=ad,DC=evotec,DC=xyz' -PrincipalType DistinguishedName # #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *

Examples/Example-08-ListingPermissionsUnknown.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrPermission -Type Unknown -Verbose
+$T | Format-Table *

Examples/Example-09-RemovingGPOPermissionUnknown.ps1

@@ -1,3 +1,3 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
-
-Remove-GPOZaurrPermission -Verbose -Type Unknown -WhatIf
+#Clear-Host
+Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 1 #-WhatIf

Examples/Example-09-RemovingGPOPermissionUnknown02.ps1

@@ -0,0 +1,19 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrPermission -Type All
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions Before' -AutoFilter -AutoFit
+
+# Step 2 - Verify couple of GPOS returned with whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4 -WhatIf
+
+# Step 3 - Confirm the change without whatif
+#Remove-GPOZaurrPermission -Verbose -Type Unknown -LimitProcessing 4
+
+# Step 4 - Analyze GPO manually to confirm only unknown sids were removed
+
+# Step 5 - if everything went ok, continue process without whatif
+
+# Step-6 - Generate new report
+#$Report = Get-GPOZaurrPermission -Type All
+#$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOutput.xlsx -ExcelWorkSheetName 'GPO Permissions After' -AutoFilter -AutoFit

Examples/Example-09-RemovingGPOpermissionNamed.ps1

@@ -1,13 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
-$Named = @(
-    'S-1-5-21-853615985-2870445339-3163598659-1105'
-)
+$T = Get-GPOZaurrPermission -GPOName 'Default DOmain Policy'
+$T | Format-Table -AutoSize *
 
-# Using exclude permission types (it may not be good idea to delete GPORead/GPOApply)
-#Remove-GPOZaurrPermission -Verbose -Type Named -WhatIf -LimitProcessing 2 -NamedObjects $Named -ExcludePermissionType GpoRead,GpoApply
-
-# But
-#Remove-GPOZaurrPermission -Type Named -NamedObjects $Named -IncludePermissionType GpoEditDeleteModifySecurity -SkipWellKnown -SkipAdministrative -Verbose -WhatIf
-
-Remove-GPOZaurrPermission -Type Named -NamedObjects $Named -SkipWellKnown -SkipAdministrative -Verbose #-WhatIf
+Remove-GPOZaurrPermission -GPOName 'Default DOmain Policy' -Principal 'S-1-5-21-853615985-2870445339-3163598659-3755' -Verbose #-WhatIf #-IncludePermissionType GpoApply #-WhatIf

Examples/Example-10-ListingGPO.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrAD | Format-Table
+Get-GPOZaurrAD -Forest 'test.evotec.pl' | Format-Table
+
+Get-GPOZaurrAD -GPOName 'Default Domain Policy' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-10-ListingGPOLong.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$GPOS = Get-GPOZaurr
+$GPOS | Format-Table -AutoSize

Examples/Example-11-ReplaceGPOOwnerAutomated.ps1

@@ -1,13 +1,17 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
 # This Example shows how to deal with GPOs that have owner that doesn't exists anymore (deleted userr or diff domain) - EmptyOrUnknown
-# And also can fix at the same time NonAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
+# And also can fix at the same time NotAdministrative - this basically looks for users/groups that are not Domain Admins or Enterprise Admins
 # regardless if current user is still Domain Admin or not
 
-$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
-$GPOs | Format-Table DisplayName, Owner, OwnerSID
+$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName
+$GPOs | Format-Table  DisplayName, Owner, OwnerSID, OwnerType, SysvolOwner, SysvolSID, SysvolType
 
-Set-GPOZaurrOwner -Type 'NonAdministrative','EmptyOrUnknown' -Verbose -LimitProcessing 3 #-WhatIf
+#Set-GPOZaurrOwner -Type Unknown -Verbose  #-LimitProcessing 2 -WhatIf
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+#Set-GPOZaurrOwner -Type NotMatching -Verbose -LimitProcessing 2 -WhatIf
 
-$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
-$GPOs | Format-Table DisplayName, Owner, OwnerSID
+#Set-GPOZaurrOwner -GPOName 'COMPUTERS | Enable Sets' -Verbose -Principal 'przemyslaw.klys' -WhatIf #-SkipSysvol
+#Set-GPOZaurrOwner -GPOName 'New Group Policy Object' -Verbose #-WhatIf #-SkipSysvol
+#$GPOs = Get-GPOZaurrOwner -IncludeSysvol #-GPOName 'New Group Policy Object'
+#$GPOs | Format-Table DisplayName, Owner, OwnerSID

Examples/Example-11-ReplaceGPOOwnerManual.ps1

@@ -1,5 +1,6 @@
 Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
 
+# You can set owner per guid if you want to have more control.
 $LImitProcessing = 2
 
 # check what is there now

Examples/Example-11-ReplaceGPOOwnerPerGPO.ps1

@@ -0,0 +1,15 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# this example shows how to replace owner of a single GPO
+
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType
+
+# If Principal is not provided Domain Admins are set as default principal
+Set-GPOZaurrOwner -GPOName 'ALL | Enable RDP' -WhatIf
+
+# If principal is given it is set (of course if it exits). Otherwise warning is returned.
+Set-GPOZaurrOwner -GPOName 'ALL | Enable RDP' -Principal 'przemyslaw.klys' #-WhatIf
+
+$GPOs = Get-GPOZaurr #-GPOName 'New Group Policy Object'
+$GPOs | Format-Table DisplayName, Owner, OwnerSID, OwnerType

Examples/Example-11-ReplaceGPOwner.ps1

@@ -0,0 +1,12 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Step 1 - Create report
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners Before' -AutoFilter -AutoFit
+
+# Step 2 - Fix owners / use WhatIf and LimitProcessing / verify changes before/after
+Set-GPOZaurrOwner -Type NotAdministrative  -Verbose -LimitProcessing 2 -WhatIf
+
+# Step 3
+$Report = Get-GPOZaurrOwner -IncludeSysvol
+$Report | ConvertTo-Excel -FilePath $Env:UserProfile\Desktop\GPOOwners.xlsx -ExcelWorkSheetName 'GPO Owners After' -AutoFilter -AutoFit

Examples/Example-13-ListingOwners01.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Owners = Get-GPOZaurr -OwnerOnly
+$Owners | Format-Table

Examples/Example-13-ListingOwners02.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol
+$T | Format-Table *
+#$T | Out-HtmlView -ScrollX
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOName 'Default Domain Policy'
+$T | Format-Table *
+
+$T = Get-GPOZaurrOwner -Verbose -IncludeSysvol -GPOGuid '4E1F9C70-1DDB-4AB6-BBA3-14A8E07F0B4B'
+$T | Format-Table *

Examples/Example-14-ListingGPOsPerOU1.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink | Format-Table -AutoSize *

Examples/Example-14-ListingGPOsPerOU2.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase 'OU=Domain Controllers,DC=ad,DC=evotec,DC=xyz' | Format-Table -AutoSize
+
+Get-GPOZaurrLink -SearchBase 'OU=Computers,OU=Production,DC=ad,DC=evotec,DC=xyz' | Format-Table -AutoSize
+
+Get-GPOZaurrLink -SearchBase 'DC=ad,DC=evotec,DC=xyz' -SearchScope Base | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU3.ps1

@@ -0,0 +1,6 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-ADOrganizationalUnit -Filter * -Properties distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+Get-ADOrganizationalUnit -Filter * -Properties canonicalname, distinguishedName, LinkedGroupPolicyObjects | Get-GPOZaurrLink | Format-Table
+Get-ADObject -Filter * -Properties distinguishedName, gplink -Server 'ad.evotec.pl' | Get-GPOZaurrLink | Format-Table -AutoSize
+Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-14-ListingGPOsPerOU4.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -Linked 'Root' -IncludeDomains 'ad.evotec.pl' | Format-Table

Examples/Example-14-ListingGPOsPerOURemoveDuplicates.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -Verbose | Format-Table -a *
+
+Get-GPOZaurrLink -SearchBase "OU=ITR01,DC=ad,DC=evotec,DC=xyz" -SkipDuplicates | Format-Table -a *

Examples/Example-14-ListingGPOsSpecial.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+Get-GPOZaurrLink -Linked Root | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked Site | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked DomainControllers | Format-Table -AutoSize
+
+Get-GPOZaurrLink -Linked Other | Format-Table -AutoSize

Examples/Example-15-FixingGPOPermissions.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLink | Format-Table -AutoSize

Examples/Example-16-AddRemoveGPOPermission01.ps1

@@ -0,0 +1,17 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-IncludeGPOObject #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+
+Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+
+$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *
+
+Add-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
+Remove-GPOZaurrPermission -GPOName 'ALL | Enable RDP' -PermissionType GpoEdit -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+
+$T = Get-GPOZaurrPermission -GPOName 'ALL | Enable RDP' #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+$T | Format-Table -AutoSize *

Examples/Example-16-AddRemoveGPOPermission02.ps1

@@ -0,0 +1,38 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Clear-Host
+
+$GPOName = 'ALL | Enable RDP'
+
+$T = Get-GPOZaurrPermission -GPOName $GPOName -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow -Principal 'Domain Admins' -PrincipalType 'Name'
+$T | Format-Table *
+
+<#
+# this will go and check for both Domain Admins / Enterprise Admins - if found won't do anything
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type Administrative -Verbose
+# this will go thru, because PrincipalType is not set to look by Name. Be precise with what you ask for
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -Verbose
+# this will be detected as already existing
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'Domain Admins' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will be added only if it doesn't exists - assuming that przemyslaw.klys is displayed in Get-GPOZaurrPermissions
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+# this will ADD system if it doesn't eists
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Type WellKnownAdministrative -Verbose
+
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -Verbose
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEditDeleteModifySecurity -Principal 'przemyslaw.klys' -Verbose
+# this will not work because we already have GPOEditDeleteModifySecurity which is higher than GpoEDIT
+Add-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoEdit -Principal 'przemyslaw.klys' -Verbose
+#>
+Add-GPOZaurrPermission -GPOName $GPOName -Type AuthenticatedUsers -PermissionType GpoRead -Verbose #-WhatIf
+
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T | Format-Table -AutoSize *
+
+#Remove-GPOZaurrPermission -GPOName $GPOName -PermissionType GpoApply -Principal 'przemyslaw.klys' -PrincipalType Name -Verbose
+
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T = Get-GPOZaurrPermission -GPOName $GPOName #-ExcludePermissionType GpoApply,GpoRead -IncludeGPOObject
+#$T | Format-Table -AutoSize *

Examples/Example-16-AddRemoveGPOPermission03.ps1

@@ -0,0 +1,12 @@
+#Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Invoke-GPOZaurrPermission -Linked Root -Verbose {
+    Set-GPOOwner -Type Administrative
+    #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
+    #Set-GPOOwner -Principal 'Domain Admins'
+    Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
+} #-WhatIf #| Format-Table *

Examples/Example-16-AddRemoveGPOPermission04.ps1

@@ -0,0 +1,11 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=Computers,OU=Production,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    #Set-GPOOwner -Principal 'EVOTEC\Enterprise Admins'
+    #Set-GPOOwner -Principal 'Domain Admins'
+    #Remove-GPOPermission -Type Administrative -IncludePermissionType GPOCustom
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity
+    #Add-GPOPermission -Type WellKnownAdministrative -IncludePermissionType GpoEditDeleteModifySecurity
+} -WhatIf #| Format-Table *

Examples/Example-16-KeepPermissions.ps1

@@ -0,0 +1,42 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-16-KeepPermissions02.ps1

@@ -0,0 +1,44 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# Apply permissions for ROOT
+Invoke-GPOZaurrPermission -Verbose -Linked Root -IncludeDomains 'ad.evotec.pl' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+
+# Apply perrmissions for Domain Controllers
+Invoke-GPOZaurrPermission -Verbose -Linked DomainControllers -IncludeDomains 'ad.evotec.xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+# Apply permissions for Regions, with exclusions for those 4 groups
+$Exclude = @(
+    'CN=ITR01_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR01,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates
+
+
+$Exclude = @(
+    'CN=ITR02_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR03_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+    #'CN=ITR04_AD Admins,OU=Security,OU=Groups,OU=Production,DC=ad,DC=evotec,DC=xyz'
+)
+
+Invoke-GPOZaurrPermission -Verbose -SearchBase 'OU=ITR02,DC=ad,DC=evotec,DC=xyz' {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow -ExcludePrincipal $Exclude -ExcludePrincipalType DistinguishedName
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf -SkipDuplicates

Examples/Example-16-KeepPermissions03.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# This is a bit special - I would read blog post before running this
+Invoke-GPOZaurrPermission -Verbose -Level 1 -Limit 1 {
+    Set-GPOOwner -Type Administrative
+    Remove-GPOPermission -Type NotAdministrative, NotWellKnownAdministrative -IncludePermissionType GpoEdit, GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type Administrative -IncludePermissionType GpoEditDeleteModifySecurity -PermitType Allow
+    Add-GPOPermission -Type AuthenticatedUsers -IncludePermissionType GpoRead -PermitType Allow
+} -WhatIf

Examples/Example-17-ListInconsistentACL.ps1

@@ -0,0 +1,4 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+Get-GPOZaurrPermissionConsistency -Type All | Format-Table

Examples/Example-17-RepairInconsistentACL.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz'
+
+Repair-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -Verbose #-WhatIf -Verbose

Examples/Example-17-RepairInconsistentACLAll.ps1

@@ -0,0 +1,5 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrPermissionConsistency -Type All | Format-Table
+
+Repair-GPOZaurrPermissionConsistency -LimitProcessing 2 -WhatIf -Verbose

Examples/Example-18-ListInconsistenciesACLAdvanced.ps1

@@ -0,0 +1,9 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+#Get-GPOZaurrPermissionConsistency -Type All -Forest 'test.evotec.pl' | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -GPOName 'Default Domain Controllers Policy' -IncludeDomains 'ad.evotec.xyz' -VerifyInheritance
+$Output | Format-Table DisplayName, DomainName, ACLConsistent, ACLConsistentInside
+$Output.ACLConsistentInsideDetails | Format-Table
+
+$Output = Get-GPOZaurrPermissionConsistency -VerifyInheritance -Type 'All'
+$Output | Format-Table

Examples/Example-19-TestSysvol.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -Verbose | Format-Table

Examples/Example-19-TestSysvolDomainControllers.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrSysvol -VerifyDomainControllers -Verbose | Format-Table *

Examples/Example-20-RemoveOrphanedFoldersSysvol.ps1

@@ -0,0 +1,7 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+# this allows you to process X amount of orphaned folders/files (good for testing)
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf -LimitProcessing 2
+
+# this runs for whole SYSVOL and checks things against GPOS
+Remove-GPOZaurrOrphanedSysvolFolders -Verbose -WhatIf

Examples/Example-21-ListLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrLegacyFiles | Format-Table -AutoSize

Examples/Example-22-RemoveLegacyADMFiles.ps1

@@ -0,0 +1,3 @@
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Remove-GPOZaurrLegacyFiles -Verbose -WhatIf

Examples/Example-23-Links.ps1

@@ -0,0 +1,14 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+#Get-GPOZaurrLinkSummary | Format-Table *
+#Get-GPOZaurrLinkSummary -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'MultipleLinks' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'OneLink' -UnlimitedProperties | Format-Table *
+#Get-GPOZaurrLinkSummary -Report 'LinksSummary' -UnlimitedProperties | Format-Table *
+
+$Report = Get-GPOZaurrLinkSummary #-UnlimitedProperties
+$Report | Format-Table *
+$Report.MultipleLinks | Format-Table *
+$Report.OneLink | Format-Table *
+$Report.LinksSummary | Format-Table *

Examples/Example-24-Links02.ps1

@@ -0,0 +1,12 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+$Report = Get-GPOZaurrLinkSummary -Report OneLink
+$Report | Format-Table
+$AffectedGPOs = foreach ($GPO in $Report) {
+    if ($GPO.Level1 -gt 1) {
+        $GPO
+    }
+}
+
+$AffectedGPOs | Format-Table *

Examples/Example-25-ListSysVolFiles.ps1

@@ -0,0 +1,6 @@
+Clear-Host
+Import-Module "$PSScriptRoot\..\GPoZaurr.psd1" -Force
+
+Get-GPOZaurrFiles -Type All | Out-HtmlView -ScrollX -Filtering -AllProperties
+Get-GPOZaurrFiles -HashAlgorithm MD5 | Select-Object -First 2 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files Just 2' -AutoFilter -AutoFit #-OpenWorkBook
+Get-GPOZaurrFiles -Type All -HashAlgorithm SHA256 | ConvertTo-Excel -FilePath $Env:USERPROFILE\Desktop\GPOListFiles.xlsx -AllProperties -ExcelWorkSheetName 'Files All' -AutoFilter -AutoFit #-OpenWorkBook

GPOZaurr.psd1

@@ -4,24 +4,24 @@
     CompanyName          = 'Evotec'
     CompatiblePSEditions = 'Desktop'
     Copyright            = '(c) 2011 - 2020 Przemyslaw Klys @ Evotec. All rights reserved.'
-    Description          = 'Group Policy Eater'
-    FunctionsToExport    = 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrWMI', 'New-GPOZaurrWMI', 'Remove-GPOZaurr', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOZaurrOwner', 'Set-GPOZaurrWMI'
+    Description          = 'Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows easy fixing for issues that you may expect finding in them.'
+    FunctionsToExport    = 'Add-GPOPermission', 'Add-GPOZaurrPermission', 'Backup-GPOZaurr', 'Get-GPOZaurr', 'Get-GPOZaurrAD', 'Get-GPOZaurrBackupInformation', 'Get-GPOZaurrFiles', 'Get-GPOZaurrLegacyFiles', 'Get-GPOZaurrLink', 'Get-GPOZaurrLinkSummary', 'Get-GPOZaurrOwner', 'Get-GPOZaurrPassword', 'Get-GPOZaurrPermission', 'Get-GPOZaurrPermissionConsistency', 'Get-GPOZaurrSysvol', 'Get-WMIFilter', 'Get-GPOZaurrWMI', 'Invoke-GPOZaurrPermission', 'New-GPOZaurrWMI', 'Remove-GPOPermission', 'Remove-GPOZaurr', 'Remove-GPOZaurrLegacyFiles', 'Remove-GPOZaurrOrphanedSysvolFolders', 'Remove-GPOZaurrPermission', 'Remove-GPOZaurrWMI', 'Repair-GPOZaurrPermissionConsistency', 'Restore-GPOZaurr', 'Save-GPOZaurrFiles', 'Set-GPOOwner', 'Set-GPOZaurrOwner'
     GUID                 = 'f7d4c9e4-0298-4f51-ad77-e8e3febebbde'
-    ModuleVersion        = '0.0.12'
+    ModuleVersion        = '0.0.44'
     PowerShellVersion    = '5.1'
     PrivateData          = @{
         PSData = @{
-            Tags                       = 'Windows', 'ActiveDirectory', 'GPO'
+            Tags                       = 'Windows', 'ActiveDirectory', 'GPO', 'GroupPolicy'
             ProjectUri                 = 'https://github.com/EvotecIT/GPOZaurr'
             ExternalModuleDependencies = 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'
         }
     }
     RequiredModules      = @{
-        ModuleVersion = '0.0.134'
+        ModuleVersion = '0.0.153'
         ModuleName    = 'PSSharedGoods'
         Guid          = 'ee272aa8-baaa-4edf-9f45-b6d6f7d844fe'
     }, @{
-        ModuleVersion = '0.0.47'
+        ModuleVersion = '0.0.58'
         ModuleName    = 'ADEssentials'
         Guid          = '9fc9fd61-7f11-4f4b-a527-084086f1905f'
     }, 'ActiveDirectory', 'GroupPolicy', 'CimCmdlets', 'Microsoft.PowerShell.Management', 'Microsoft.PowerShell.Utility'

Private/Get-ADAdministrativeGroups.ps1

@@ -1,74 +0,0 @@
-
-function Get-ADADministrativeGroups {
-    <#
-    .SYNOPSIS
-    Short description
-
-    .DESCRIPTION
-    Long description
-
-    .PARAMETER Type
-    Parameter description
-
-    .PARAMETER Forest
-    Parameter description
-
-    .PARAMETER ExcludeDomains
-    Parameter description
-
-    .PARAMETER IncludeDomains
-    Parameter description
-
-    .PARAMETER ExtendedForestInformation
-    Parameter description
-
-    .EXAMPLE
-    Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins
-
-    Output (Where VALUE is Get-ADGroup output):
-    Name                           Value
-    ----                           -----
-    ByNetBIOS                      {EVOTEC\Domain Admins, EVOTEC\Enterprise Admins, EVOTECPL\Domain Admins}
-    ad.evotec.xyz                  {DomainAdmins, EnterpriseAdmins}
-    ad.evotec.pl                   {DomainAdmins}
-
-    .NOTES
-    General notes
-    #>
-    [cmdletBinding()]
-    param(
-        [parameter(Mandatory)][validateSet('DomainAdmins', 'EnterpriseAdmins')][string[]] $Type,
-        [alias('ForestName')][string] $Forest,
-        [string[]] $ExcludeDomains,
-        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
-    )
-    $ADDictionary = [ordered] @{ }
-    $ADDictionary['ByNetBIOS'] = [ordered] @{ }
-    $ADDictionary['BySID'] = [ordered] @{ }
-
-    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-    foreach ($Domain in $ForestInformation.Domains) {
-        $ADDictionary[$Domain] = [ordered] @{ }
-        $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-        $DomainInformation = Get-ADDomain -Server $QueryServer
-
-        if ($Type -contains 'DomainAdmins') {
-            Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-512'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
-                $ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
-                $ADDictionary[$Domain]['DomainAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
-                $ADDictionary['BySID'][$_.SID.Value] = $_
-            }
-        }
-        if ($Type -contains 'EnterpriseAdmins') {
-            Get-ADGroup -Filter "SID -eq '$($DomainInformation.DomainSID)-519'" -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
-                $ADDictionary['ByNetBIOS']["$($DomainInformation.NetBIOSName)\$($_.Name)"] = $_
-                $ADDictionary[$Domain]['EnterpriseAdmins'] = "$($DomainInformation.NetBIOSName)\$($_.Name)"
-                $ADDictionary['BySID'][$_.SID.Value] = $_ #"$($DomainInformation.NetBIOSName)\$($_.Name)"
-            }
-        }
-    }
-    return $ADDictionary
-}
-
-#Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins

Private/Get-PrivGPOZaurrLInk.ps1

@@ -0,0 +1,75 @@
+function Get-PrivGPOZaurrLink {
+    [cmdletBinding()]
+    param(
+        [Microsoft.ActiveDirectory.Management.ADObject] $Object,
+        [switch] $Limited,
+        [System.Collections.IDictionary] $GPOCache
+    )
+    if ($Object.GpLink -and $Object.GpLink.Trim() -ne '') {
+        #$Object.GpLink -split { $_ -eq '[' -or $_ -eq ']' } -replace ';0' -replace 'LDAP://'
+        $Object.GpLink -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            #Write-Verbose $_
+            if ($_.Length -gt 10) {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
+                $Output = [ordered] @{
+                    DistinguishedName = $Object.DistinguishedName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
+                    Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
+                }
+                $Search = -join ($DomainCN, $Output['Guid'])
+                if ($GPOCache -and -not $Limited) {
+                    if ($GPOCache[$Search]) {
+                        $Output['DisplayName'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
+                }
+            }
+        }
+    } elseif ($Object.LinkedGroupPolicyObjects -and $Object.LinkedGroupPolicyObjects.Trim() -ne '') {
+        $Object.LinkedGroupPolicyObjects -split '\[LDAP://' -split ';' | ForEach-Object -Process {
+            if ($_.Length -gt 10) {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDomainCN
+                $Output = [ordered] @{
+                    DistinguishedName = $Object.DistinguishedName
+                    CanonicalName     = if ($Object.CanonicalName) { $Object.CanonicalName.TrimEnd('/') } else { $Object.CanonicalName }
+                    Guid              = [Regex]::Match( $_, '(?={)(.*)(?<=})').Value -replace '{' -replace '}'
+                }
+                $Search = -join ($DomainCN, $Output['Guid'])
+                if ($GPOCache -and -not $Limited) {
+                    if ($GPOCache[$Search]) {
+                        $Output['Name'] = $GPOCache[$Search].DisplayName
+                        $Output['DomainName'] = $GPOCache[$Search].DomainName
+                        $Output['Owner'] = $GPOCache[$Search].Owner
+                        $Output['GpoStatus'] = $GPOCache[$Search].GpoStatus
+                        $Output['Description'] = $GPOCache[$Search].Description
+                        $Output['CreationTime'] = $GPOCache[$Search].CreationTime
+                        $Output['ModificationTime'] = $GPOCache[$Search].ModificationTime
+                        $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                        $Output['GPODistinguishedName'] = $_
+                        [PSCustomObject] $Output
+                    } else {
+                        Write-Warning "Get-PrivGPOZaurrLink - Couldn't find link $Search in a GPO Cache. Lack of permissions for given GPO? Are you running as admin? Skipping."
+                    }
+                } else {
+                    $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_ -ToDC
+                    $Output['GPODistinguishedName'] = $_
+                    [PSCustomObject] $Output
+                }
+            }
+        }
+    }
+}

Private/Get-PrivPermission.ps1

@@ -2,111 +2,259 @@
     [cmdletBinding()]
     param(
         [Microsoft.GroupPolicy.Gpo] $GPO,
+        [Object] $SecurityRights,
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
         [switch] $IncludeOwner,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
         [switch] $IncludeGPOObject,
         [System.Collections.IDictionary] $ADAdministrativeGroups,
-        [string[]] $Type
+        [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
+        [System.Collections.IDictionary] $Accounts,
+        [System.Collections.IDictionary] $ExtendedForestInformation
     )
-
-    # $GPO = $_
-    Write-Verbose "Get-GPOZaurrPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
-    $SecurityRights = $GPO.GetSecurityInfo()
-    $SecurityRights | ForEach-Object -Process {
-        #Get-GPPermissions -Guid $GPO.ID -DomainName $GPO.DomainName -All -Server $QueryServer | ForEach-Object -Process {
-        $GPOPermission = $_
-        if ($ExcludePermissionType -contains $GPOPermission.Permission) {
-            return
-        }
-        if ($IncludePermissionType) {
-            if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
-                return
-            }
-        }
-        if ($SkipWellKnown.IsPresent) {
-            if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
-                return
-            }
-        }
-        if ($SkipAdministrative.IsPresent) {
-            $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
-            if ($IsAdministrative) {
-                return
-            }
-        }
-        if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
-            # May need updates if there's more types
-            if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
-                return
-            }
-        }
-
-        $ReturnObject = [ordered] @{
-            DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-            GUID              = $GPO.ID
-            DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-            Enabled           = $GPO.GpoStatus
-            Description       = $GPO.Description
-            CreationDate      = $GPO.CreationTime
-            ModificationTime  = $GPO.ModificationTime
-            Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
-            Inherited         = $GPOPermission.Inherited   # : False
-            Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
-            DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-            Name              = $GPOPermission.Trustee.Name    #: Domain Admins
-            Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-            SidType           = $GPOPermission.Trustee.SidType #: Group
-
-        }
-        if ($IncludeGPOObject) {
-            $ReturnObject.GPOObject = $GPO
-            $ReturnObject.GPOSecurity = $SecurityRights
-        }
-        [PSCustomObject] $ReturnObject
+    Begin {
+        Write-Verbose "Get-PrivPermission - Processing $($GPO.DisplayName) from $($GPO.DomainName)"
     }
-    if ($IncludeOwner.IsPresent) {
-        if ($GPO.Owner) {
-            $SplittedOwner = $GPO.Owner.Split('\')
-            $DomainOwner = $SplittedOwner[0]  #: EVOTEC
-            $DomainUserName = $SplittedOwner[1]   #: Domain Admins
-            $SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
-            if ($SID) {
-                $SIDType = 'Group'
-                $DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
+    Process {
+        $SecurityRights | ForEach-Object -Process {
+            $GPOPermission = $_
+            if ($PermitType -ne 'All') {
+                if ($PermitType -eq 'Deny') {
+                    if ($GPOPermission.Denied -eq $false) {
+                        return
+                    }
+                } else {
+                    if ($GPOPermission.Denied -eq $true) {
+                        return
+                    }
+                }
+            }
+            if ($ExcludePermissionType -contains $GPOPermission.Permission) {
+                return
+            }
+            if ($IncludePermissionType) {
+                if ($IncludePermissionType -notcontains $GPOPermission.Permission) {
+                    if ($IncludePermissionType -eq 'GpoRead' -and $GPOPermission.Permission -eq 'GpoApply') {
+                        # We treat GpoApply as GpoRead as well. This is because when GpoApply is set it becomes GpoRead as well but of course not vice versa
+                    } else {
+                        return
+                    }
+                }
+            }
+            if ($SkipWellKnown.IsPresent -or $Type -contains 'NotWellKnown') {
+                if ($GPOPermission.Trustee.SidType -eq 'WellKnownGroup') {
+                    return
+                }
+            }
+            if ($SkipAdministrative.IsPresent -or $Type -contains 'NotAdministrative') {
+                $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
+                if ($IsAdministrative) {
+                    return
+                }
+            }
+            if ($Type -contains 'Administrative' -and $Type -notcontains 'All') {
+                $IsAdministrative = $ADAdministrativeGroups['BySID'][$GPOPermission.Trustee.Sid.Value]
+                if (-not $IsAdministrative) {
+                    return
+                }
+            }
+            if ($Type -contains 'NotWellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($GPOPermission.Trustee.Sid -eq 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'WellKnownAdministrative' -and $Type -notcontains 'All') {
+                # We check for SYSTEM account
+                # Maybe we should make it a function and provide more
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-18') {
+                    return
+                }
+            }
+            if ($Type -contains 'Unknown' -and $Type -notcontains 'All') {
+                # May need updates if there's more types
+                if ($GPOPermission.Trustee.SidType -ne 'Unknown') {
+                    return
+                }
+            }
+            if ($Type -contains 'AuthenticatedUsers' -and $Type -notcontains 'All') {
+                if ($GPOPermission.Trustee.Sid -ne 'S-1-5-11') {
+                    return
+                }
+            }
+            if ($Type -contains 'DomainComputers' -and $Type -notcontains 'All') {
+                $DomainComputersSID = -join ($ExtendedForestInformation['DomainsExtended'][$GPO.DomainName].DomainSID, '-515')
+                if ($GPOPermission.Trustee.Sid -ne $DomainComputersSID) {
+                    return
+                }
+            }
+            if ($Principal) {
+                if ($PrincipalType -eq 'Sid') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'DistinguishedName') {
+                    if ($Principal -notcontains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($PrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($Principal -notcontains $UserMerge -and $Principal -notcontains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
+            if ($ExcludePrincipal) {
+                if ($ExcludePrincipalType -eq 'Sid') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.Sid.Value) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'DistinguishedName') {
+                    if ($ExcludePrincipal -contains $GPOPermission.Trustee.DSPath) {
+                        return
+                    }
+                } elseif ($ExcludePrincipalType -eq 'Name') {
+                    $UserMerge = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                    if ($ExcludePrincipal -contains $UserMerge -or $ExcludePrincipal -contains $GPOPermission.Trustee.Name) {
+                        return
+                    }
+                }
+            }
+            $ReturnObject = [ordered] @{
+                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID              = $GPO.ID
+                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled           = $GPO.GpoStatus
+                Description       = $GPO.Description
+                CreationDate      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+                PermissionType    = if ($GPOPermission.Denied -eq $true) { 'Deny' } else { 'Allow' }
+                Permission        = $GPOPermission.Permission  # : GpoEditDeleteModifySecurity
+                Inherited         = $GPOPermission.Inherited   # : False
+                Domain            = $GPOPermission.Trustee.Domain  #: EVOTEC
+                DistinguishedName = $GPOPermission.Trustee.DSPath  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                Name              = $GPOPermission.Trustee.Name    #: Domain Admins
+                Sid               = $GPOPermission.Trustee.Sid.Value     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                SidType           = $GPOPermission.Trustee.SidType #: Group
+            }
+            if ($Accounts) {
+                $A = -join ($GPOPermission.Trustee.Domain, '\', $GPOPermission.Trustee.Name)
+                if ($A -and $Accounts[$A]) {
+                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+                    if (-not $ReturnObject['Sid']) {
+                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+                    }
+                    if ($Accounts[$A].ObjectClass -eq 'group') {
+                        $ReturnObject['SidType'] = 'Group'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                        $ReturnObject['SidType'] = 'User'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                        $ReturnObject['SidType'] = 'Computer'
+                    } else {
+                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+                    }
+                } else {
+                    $ReturnObject['UserPrincipalName'] = ''
+                    $ReturnObject['AccountEnabled'] = ''
+                    $ReturnObject['PasswordLastSet'] = ''
+                    $ReturnObject['LastLogonDate'] = ''
+                }
+            }
+            if ($IncludeGPOObject) {
+                $ReturnObject['GPOObject'] = $GPO
+                $ReturnObject['GPOSecurity'] = $SecurityRights
+                $ReturnObject['GPOSecurityPermissionItem'] = $GPOPermission
+            }
+            [PSCustomObject] $ReturnObject
+        }
+        if ($IncludeOwner.IsPresent) {
+            if ($GPO.Owner) {
+                $SplittedOwner = $GPO.Owner.Split('\')
+                $DomainOwner = $SplittedOwner[0]  #: EVOTEC
+                $DomainUserName = $SplittedOwner[1]   #: Domain Admins
+                $SID = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].Sid.Value
+                if ($SID) {
+                    $SIDType = 'Group'
+                    $DistinguishedName = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"].DistinguishedName
+                } else {
+                    $SIDType = ''
+                    $DistinguishedName = ''
+                }
             } else {
-                $SIDType = ''
+                $DomainOwner = $GPO.Owner
+                $DomainUserName = ''
+                $SID = ''
+                $SIDType = 'EmptyOrUnknown'
                 $DistinguishedName = ''
             }
-        } else {
-            $DomainOwner = $GPO.Owner
-            $DomainUserName = ''
-            $SID = ''
-            $SIDType = ''
-            $DistinguishedName = ''
+            $ReturnObject = [ordered] @{
+                DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
+                GUID              = $GPO.Id
+                DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
+                Enabled           = $GPO.GpoStatus
+                Description       = $GPO.Description
+                CreationDate      = $GPO.CreationTime
+                ModificationTime  = $GPO.ModificationTime
+                Permission        = 'GpoOwner'  # : GpoEditDeleteModifySecurity
+                Inherited         = $false  # : False
+                Domain            = $DomainOwner
+                DistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
+                Name              = $DomainUserName
+                Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
+                SidType           = $SIDType #  #: Group
+            }
+            if ($Accounts) {
+                $A = $GPO.Owner
+                if ($A -and $Accounts[$A]) {
+                    $ReturnObject['UserPrincipalName'] = $Accounts[$A].UserPrincipalName
+                    $ReturnObject['AccountEnabled'] = $Accounts[$A].Enabled
+                    $ReturnObject['DistinguishedName'] = $Accounts[$A].DistinguishedName
+                    $ReturnObject['PasswordLastSet'] = if ($Accounts[$A].PasswordLastSet) { $Accounts[$A].PasswordLastSet } else { '' }
+                    $ReturnObject['LastLogonDate'] = if ($Accounts[$A].LastLogonDate ) { $Accounts[$A].LastLogonDate } else { '' }
+                    if (-not $ReturnObject['Sid']) {
+                        $ReturnObject['Sid'] = $Accounts[$A].Sid.Value
+                    }
+                    if ($Accounts[$A].ObjectClass -eq 'group') {
+                        $ReturnObject['SidType'] = 'Group'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'user') {
+                        $ReturnObject['SidType'] = 'User'
+                    } elseif ($Accounts[$A].ObjectClass -eq 'computer') {
+                        $ReturnObject['SidType'] = 'Computer'
+                    } else {
+                        $ReturnObject['SidType'] = 'EmptyOrUnknown'
+                    }
+                } else {
+                    $ReturnObject['UserPrincipalName'] = ''
+                    $ReturnObject['AccountEnabled'] = ''
+                    $ReturnObject['PasswordLastSet'] = ''
+                    $ReturnObject['LastLogonDate'] = ''
+                }
+            }
+            if ($IncludeGPOObject) {
+                $ReturnObject['GPOObject'] = $GPO
+                $ReturnObject['GPOSecurity'] = $SecurityRights
+                $ReturnObject['GPOSecurityPermissionItem'] = $null
+            }
+            [PSCustomObject] $ReturnObject
         }
-        $ReturnObject = [ordered] @{
-            DisplayName       = $GPO.DisplayName #      : ALL | Enable RDP
-            GUID              = $GPO.GUID
-            DomainName        = $GPO.DomainName  #      : ad.evotec.xyz
-            Enabled           = $GPO.GpoStatus
-            Description       = $GPO.Description
-            CreationDate      = $GPO.CreationTime
-            ModificationTime  = $GPO.ModificationTime
-            Permission        = 'GpoOwner'  # : GpoEditDeleteModifySecurity
-            Inherited         = $false  # : False
-            Domain            = $DomainOwner
-            DistinguishedName = $DistinguishedName  #: CN = Domain Admins, CN = Users, DC = ad, DC = evotec, DC = xyz
-            Name              = $DomainUserName
-            Sid               = $SID     #: S - 1 - 5 - 21 - 853615985 - 2870445339 - 3163598659 - 512
-            SidType           = $SIDType #  #: Group
-        }
-        if ($IncludeGPOObject) {
-            $ReturnObject.GPOObject = $GPO
-            $ReturnObject.GPOSecurity = $SecurityRights
-        }
-        [PSCustomObject] $ReturnObject
+    }
+    End {
+
     }
 }

Private/Get-XMLGPO.ps1

@@ -3,7 +3,9 @@
     param(
         [XML] $XMLContent,
         [Microsoft.GroupPolicy.Gpo] $GPO,
-        [switch] $PermissionsOnly
+        [switch] $PermissionsOnly,
+        [switch] $OwnerOnly,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     if ($XMLContent.GPO.LinksTo) {
         $Linked = $true
@@ -34,41 +36,68 @@
     } elseif ($UserEnabled -eq $false -and $ComputerEnabled -eq $true) {
         $Enabled = 'User configuration settings disabled'
     }
-
+    if (-not $PermissionsOnly) {
+        if ($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text') {
+            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text')"]
+            $WellKnown = ConvertFrom-SID -SID $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text' -OnlyWellKnown
+            if ($AdministrativeGroup) {
+                $OwnerType = 'Administrative'
+            } elseif ($WellKnown.Name) {
+                $OwnerType = 'WellKnown'
+            } else {
+                $OwnerType = 'NotAdministrative'
+            }
+        } else {
+            $OwnerType = 'EmptyOrUnknown'
+        }
+    }
     if ($PermissionsOnly) {
         [PsCustomObject] @{
-            'DisplayName'    = $XMLContent.GPO.Name
-            'DomainName'     = $XMLContent.GPO.Identifier.Domain.'#text'
-            'GUID'           = $XMLContent.GPO.Identifier.Identifier.InnerText
-            'Enabled'        = $Enabled
-            'Name'           = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
-            'Sid'            = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'DisplayName'          = $XMLContent.GPO.Name
+            'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Enabled'              = $Enabled
+            'Name'                 = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'Sid'                  = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
             #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
-            'PermissionType' = 'Allow'
-            'Inherited'      = $false
-            'Permissions'    = 'Owner'
+            'PermissionType'       = 'Allow'
+            'Inherited'            = $false
+            'Permissions'          = 'Owner'
+            'GPODistinguishedName' = $GPO.Path
         }
         $XMLContent.GPO.SecurityDescriptor.Permissions.TrusteePermissions | ForEach-Object -Process {
             if ($_) {
                 [PsCustomObject] @{
-                    'DisplayName'    = $XMLContent.GPO.Name
-                    'DomainName'     = $XMLContent.GPO.Identifier.Domain.'#text'
-                    'GUID'           = $XMLContent.GPO.Identifier.Identifier.InnerText
-                    'Enabled'        = $Enabled
-                    'Name'           = $_.trustee.name.'#Text'
-                    'Sid'            = $_.trustee.SID.'#Text'
+                    'DisplayName'          = $XMLContent.GPO.Name
+                    'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+                    'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+                    'Enabled'              = $Enabled
+                    'Name'                 = $_.trustee.name.'#Text'
+                    'Sid'                  = $_.trustee.SID.'#Text'
                     #'SidType'        = if (($XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text').Length -le 10) { 'WellKnown' } else { 'Other' }
-                    'PermissionType' = $_.type.PermissionType
-                    'Inherited'      = if ($_.Inherited -eq 'false') { $false } else { $true }
-                    'Permissions'    = $_.Standard.GPOGroupedAccessEnum
+                    'PermissionType'       = $_.type.PermissionType
+                    'Inherited'            = if ($_.Inherited -eq 'false') { $false } else { $true }
+                    'Permissions'          = $_.Standard.GPOGroupedAccessEnum
+                    'GPODistinguishedName' = $GPO.Path
                 }
             }
         }
+    } elseif ($OwnerOnly) {
+        [PsCustomObject] @{
+            'DisplayName'          = $XMLContent.GPO.Name
+            'DomainName'           = $XMLContent.GPO.Identifier.Domain.'#text'
+            'GUID'                 = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
+            'Enabled'              = $Enabled
+            'Owner'                = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
+            'OwnerSID'             = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'            = $OwnerType
+            'GPODistinguishedName' = $GPO.Path
+        }
     } else {
         [PsCustomObject] @{
             'DisplayName'                       = $XMLContent.GPO.Name
             'DomainName'                        = $XMLContent.GPO.Identifier.Domain.'#text'
-            'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText
+            'GUID'                              = $XMLContent.GPO.Identifier.Identifier.InnerText -replace '{' -replace '}'
             'Linked'                            = $Linked
             'LinksCount'                        = $LinksCount
             'Enabled'                           = $Enabled
@@ -89,10 +118,11 @@
 
             'WMIFilter'                         = $GPO.WmiFilter.name
             'WMIFilterDescription'              = $GPO.WmiFilter.Description
-            'DistinguishedName'                 = $GPO.Path
+            'GPODistinguishedName'              = $GPO.Path
             'SDDL'                              = if ($Splitter -ne '') { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' -join $Splitter } else { $XMLContent.GPO.SecurityDescriptor.SDDL.'#text' }
             'Owner'                             = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'
             'OwnerSID'                          = $XMLContent.GPO.SecurityDescriptor.Owner.SID.'#text'
+            'OwnerType'                         = $OwnerType
             'ACL'                               = @(
                 [PsCustomObject] @{
                     'Name'           = $XMLContent.GPO.SecurityDescriptor.Owner.Name.'#text'

Private/Remove-PrivPermission.ps1

@@ -0,0 +1,66 @@
+function Remove-PrivPermission {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [string] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+        [PSCustomObject] $GPOPermission,
+        [alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType
+    )
+    if ($GPOPermission.Name) {
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: $($GPOPermission.Domain)\$($GPOPermission.Name), SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+    } else {
+        $Text = "Removing SID: $($GPOPermission.Sid), Name: EMPTY, SidType: $($GPOPermission.SidType) from domain $($GPOPermission.DomainName)"
+    }
+    if ($PrincipalType -eq 'DistinguishedName') {
+        if ($GPOPermission.DistinguishedName -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                }
+            }
+        }
+    } elseif ($PrincipalType -eq 'Sid') {
+        if ($GPOPermission.Sid -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    if ($_.Exception.Message -like '*The request is not supported. (Exception from HRESULT: 0x80070032)*') {
+                        Write-Warning "Remove-GPOZaurrPermission - Bummer! The request is not supported, but lets fix it differently."
+                        # This is basically atomic approach. We will totally remove any permissions for that user on ACL level to get rid of this situation.
+                        # This situation should only happen if DENY is on FULL Control
+                        $ACL = Get-ADACL -ADObject $GPOPermission.GPOObject.Path -Bundle #-Verbose:$VerbosePreference
+                        if ($ACL) {
+                            Remove-ADACL -ACL $ACL -Principal $Principal -AccessControlType Deny -Verbose:$VerbosePreference
+                        }
+                        # I've noticed that in situation where Edit settings, delete, modify security is set and then set to Deny we need to fix it once more
+                        $ACL = Get-ADACL -ADObject $GPOPermission.GPOObject.Path -Bundle
+                        if ($ACL) {
+                            Remove-ADACL -ACL $ACL -Principal $Principal -AccessControlType Allow -Verbose:$VerbosePreference
+                        }
+                    } else {
+                        Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
+    } elseif ($PrincipalType -eq 'Name') {
+        if ($GPOPermission.Name -eq $Principal -and $GPOPermission.Permission -eq $IncludePermissionType) {
+            if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, $Text)) {
+                try {
+                    Write-Verbose "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType for $($Principal) / $($GPOPermission.Name) / Type: $($GPOPermission.PermissionType)"
+                    $GPOPermission.GPOSecurity.Remove($GPOPermission.GPOSecurityPermissionItem)
+                    $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                } catch {
+                    Write-Warning "Remove-GPOZaurrPermission - Removing permission $IncludePermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                }
+            }
+        }
+    }
+}

Private/Test-SysvolFolders.ps1

@@ -0,0 +1,119 @@
+function Test-SysVolFolders {
+    [cmdletBinding()]
+    param(
+        [Array] $GPOs,
+        [string] $Server,
+        [string] $Domain
+    )
+    $Differences = @{ }
+    $SysvolHash = @{ }
+
+    $GPOGUIDS = $GPOs.ID.GUID
+    try {
+        $SYSVOL = Get-ChildItem -Path "\\$($Server)\SYSVOL\$Domain\Policies" -ErrorAction Stop
+    } catch {
+        $Sysvol = $Null
+    }
+    foreach ($_ in $SYSVOL) {
+        $GUID = $_.Name -replace '{' -replace '}'
+        $SysvolHash[$GUID] = $_
+    }
+    $Files = $SYSVOL.Name -replace '{' -replace '}'
+    if ($Files) {
+        $Comparing = Compare-Object -ReferenceObject $GPOGUIDS -DifferenceObject $Files -IncludeEqual
+        foreach ($_ in $Comparing) {
+            if ($_.SideIndicator -eq '==') {
+                $Found = 'Exists'
+            } elseif ($_.SideIndicator -eq '<=') {
+                $Found = 'Not available on SYSVOL'
+            } elseif ($_.SideIndicator -eq '=>') {
+                $Found = 'Orphaned GPO'
+            } else {
+                $Found = 'Orphaned GPO'
+            }
+            $Differences[$_.InputObject] = $Found
+        }
+    }
+    $GPOSummary = @(
+        foreach ($GPO in $GPOS) {
+            if ($null -ne $SysvolHash[$GPO.Id.GUID].FullName) {
+                $FullPath = $SysvolHash[$GPO.Id.GUID].FullName
+                try {
+                    $ACL = Get-Acl -Path $SysvolHash[$GPO.Id.GUID].FullName -ErrorAction Stop
+                    $Owner = $ACL.Owner
+                    $ErrorMessage = ''
+                } catch {
+                    Write-Warning "Get-GPOZaurrSysvol - ACL reading (1) failed for $FullPath with error: $($_.Exception.Message)"
+                    $ACL = $null
+                    $Owner = ''
+                    $ErrorMessage = $_.Exception.Message
+                }
+            } else {
+                $ACL = $null
+            }
+            if ($null -eq $Differences[$GPO.Id.Guid]) {
+                $SysVolStatus = 'Not available on SYSVOL'
+            } else {
+                $SysVolStatus = $Differences[$GPO.Id.Guid]
+            }
+            [PSCustomObject] @{
+                DisplayName      = $GPO.DisplayName
+                Status           = $Differences[$GPO.Id.Guid]
+                DomainName       = $GPO.DomainName
+                SysvolServer     = $Server
+                SysvolStatus     = $SysVolStatus
+                Owner            = $GPO.Owner
+                FileOwner        = $Owner
+                Id               = $GPO.Id.Guid
+                GpoStatus        = $GPO.GpoStatus
+                Path             = $FullPath
+                Description      = $GPO.Description
+                CreationTime     = $GPO.CreationTime
+                ModificationTime = $GPO.ModificationTime
+                UserVersion      = $GPO.UserVersion
+                ComputerVersion  = $GPO.ComputerVersion
+                WmiFilter        = $GPO.WmiFilter
+                Error            = $ErrorMessage
+            }
+        }
+        # Now we need to list thru Sysvol files and fine those that do not exists as GPO and create dummy GPO objects to show orphaned gpos
+        foreach ($_ in $Differences.Keys) {
+            if ($Differences[$_] -eq 'Orphaned GPO') {
+                if ($SysvolHash[$_].BaseName -notcontains 'PolicyDefinitions') {
+                    $FullPath = $SysvolHash[$_].FullName
+                    try {
+                        $ACL = Get-Acl -Path $FullPath -ErrorAction Stop
+                        $Owner = $ACL.Owner
+                        $ErrorMessage = ''
+                    } catch {
+                        Write-Warning "Get-GPOZaurrSysvol - ACL reading (2) failed for $FullPath with error: $($_.Exception.Message)"
+                        $ACL = $null
+                        $Owner = $null
+                        $ErrorMessage = $_.Exception.Message
+                    }
+
+                    [PSCustomObject] @{
+                        DisplayName      = $SysvolHash[$_].BaseName
+                        Status           = 'Orphaned GPO'
+                        DomainName       = $Domain
+                        SysvolServer     = $Server
+                        SysvolStatus     = $Differences[$GPO.Id.Guid]
+                        Owner            = ''
+                        FileOwner        = $Owner
+                        Id               = $_
+                        GpoStatus        = 'Orphaned'
+                        Path             = $FullPath
+                        Description      = $null
+                        CreationTime     = $SysvolHash[$_].CreationTime
+                        ModificationTime = $SysvolHash[$_].LastWriteTime
+                        UserVersion      = $null
+                        ComputerVersion  = $null
+                        WmiFilter        = $null
+                        Error            = $ErrorMessage
+                    }
+                }
+            }
+        }
+    )
+    $GPOSummary | Sort-Object -Property DisplayName
+}

Public/Add-GPOPermission.ps1

@@ -0,0 +1,41 @@
+function Add-GPOPermission {
+    [cmdletBinding()]
+    param(
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+        [Microsoft.GroupPolicy.GPPermissionType] $IncludePermissionType,
+        [alias('Trustee')][Array] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+        [validateSet('Allow', 'Deny')][string] $PermitType = 'Allow'
+    )
+    if ($Type -eq 'Default') {
+        @{
+            Action                = 'Add'
+            Type                  = 'Default'
+            Principal             = $Principal
+            IncludePermissionType = $IncludePermissionType
+            PrincipalType         = $PrincipalType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'AuthenticatedUsers') {
+        @{
+            Action                = 'Add'
+            Type                  = 'AuthenticatedUsers'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'Administrative') {
+        @{
+            Action                = 'Add'
+            Type                  = 'Administrative'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    } elseif ($Type -eq 'WellKnownAdministrative') {
+        @{
+            Action                = 'Add'
+            Type                  = 'WellKnownAdministrative'
+            IncludePermissionType = $IncludePermissionType
+            PermitType            = $PermitType
+        }
+    }
+}

Public/Add-GPOZaurrPermission.ps1

@@ -0,0 +1,213 @@
+function Add-GPOZaurrPermission {
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'GPOGUID')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName', Mandatory)]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [Parameter(ParameterSetName = 'ADObject', Mandatory)]
+        [alias('OrganizationalUnit', 'DistinguishedName')][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
+
+        [validateset('WellKnownAdministrative', 'Administrative', 'AuthenticatedUsers', 'Default')][string] $Type = 'Default',
+
+        [alias('Trustee')][string] $Principal,
+        [alias('TrusteeType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'DistinguishedName',
+
+        [Parameter(Mandatory)][alias('IncludePermissionType')][Microsoft.GroupPolicy.GPPermissionType] $PermissionType,
+        [switch] $Inheritable,
+
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [int] $LimitProcessing
+    )
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+    if (-not $ADAdministrativeGroups) {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    if ($GPOName) {
+        $Splat = @{
+            GPOName = $GPOName
+        }
+    } elseif ($GPOGUID) {
+        $Splat = @{
+            GPOGUID = $GPOGUID
+        }
+    } else {
+        $Splat = @{}
+    }
+    $Splat['IncludeGPOObject'] = $true
+    $Splat['Forest'] = $Forest
+    $Splat['IncludeDomains'] = $IncludeDomains
+    if ($Type -ne 'Default') {
+        $Splat['Type'] = $Type
+    }
+    $Splat['PermitType'] = $PermitType
+    $Splat['Principal'] = $Principal
+    if ($PrincipalType) {
+        $Splat.PrincipalType = $PrincipalType
+    }
+    $Splat['ExcludeDomains'] = $ExcludeDomains
+    $Splat['ExtendedForestInformation'] = $ExtendedForestInformation
+    #$Splat['ExcludePermissionType'] = $ExcludePermissionType
+    $Splat['IncludePermissionType'] = $PermissionType
+    $Splat['SkipWellKnown'] = $SkipWellKnown.IsPresent
+    $Splat['SkipAdministrative'] = $SkipAdministrative.IsPresent
+
+    $AdministrativeExists = @{
+        DomainAdmins     = $false
+        EnterpriseAdmins = $false
+    }
+
+    # This should always return results. When no data is found it should return basic information that will allow us to add credentials.
+    [Array] $GPOPermissions = Get-GPOZaurrPermission @Splat -ReturnSecurityWhenNoData
+    # When it has GPOSecurityPermissionItem property it means it has permissions, if it doesn't it means we have clean object to process
+    if ($GPOPermissions.GPOSecurityPermissionItem) {
+        # Permission exists, but may be incomplete
+        foreach ($GPOPermission in $GPOPermissions) {
+            if ($Type -eq 'Default') {
+                # We were looking for specific principal and we got it. nothing to do
+                # this is for standard users such as przemyslaw.klys / adam.gonzales
+                return
+            } elseif ($Type -eq 'Administrative') {
+                # We are looking for administrative but we need to make sure we got correct administrative
+                if ($GPOPermission.Permission -eq $PermissionType) {
+                    $AdministrativeGroup = $ADAdministrativeGroups['BySID'][$GPOPermission.SID]
+                    if ($AdministrativeGroup.SID -like '*-519') {
+                        $AdministrativeExists['EnterpriseAdmins'] = $true
+                    } elseif ($AdministrativeGroup.SID -like '*-512') {
+                        $AdministrativeExists['DomainAdmins'] = $true
+                    }
+                    <#
+                    if ($AdministrativeGroup) {
+                        $DomainAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-512')
+                        $EnterpriseAdminsSID = -join ($ForestInformation['DomainsExtended'][$GPOPermission.DomainName].DomainSID, '-519')
+                        if ($GPOPermission.SID -eq $DomainAdminsSID) {
+                            $AdministrativeExists['DomainAdmins'] = $true
+                        } elseif ($GPOPermission.SID -eq $EnterpriseAdminsSID) {
+                            $AdministrativeExists['EnterpriseAdmins'] = $true
+                        }
+                    }
+                    #>
+                }
+            } elseif ($Type -eq 'WellKnownAdministrative') {
+                # this is for SYSTEM account
+                return
+            } elseif ($Type -eq 'AuthenticatedUsers') {
+                # this is for Authenticated Users
+                return
+            }
+        }
+    }
+    if (-not $GPOPermissions) {
+        # This is bad - things went wrong
+        Write-Warning "Add-GPOZaurrPermission - Couldn't get permissions for GPO. Things aren't what they should be. Skipping!"
+    } else {
+        $GPO = $GPOPermissions[0]
+        if ($GPOPermissions.GPOSecurityPermissionItem) {
+            # We asked, we got response, now we need to check if maybe we're missing one of the two administrative groups
+            if ($Type -eq 'Administrative') {
+                # this is a case where something was returned. Be it Domain Admins or Enterprise Admins or both. But we still need to check because it may have been Domain Admins from other domain or just one of the two required groups
+                if ($AdministrativeExists['DomainAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
+                    }
+                }
+                if ($AdministrativeExists['EnterpriseAdmins'] -eq $false) {
+                    $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                    Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                    if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                        try {
+                            $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                            $GPO.GPOSecurity.Add($AddPermission)
+                            $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                        } catch {
+                            Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                        }
+                    }
+                }
+            } elseif ($Type -eq 'Default') {
+                # This shouldn't really happen, as if we got response, and it didn't exists it wouldn't be here
+                Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType skipped for $($Principal). This shouldn't even happen!"
+            }
+        } else {
+            # We got no response. That means we either asked incorrectly or we need to fix permission. Trying to do so
+            if ($Type -eq 'Default') {
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal)"
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'Administrative') {
+                # this is a case where both Domain Admins/Enterprise Admins were missing
+                $Principal = $ADAdministrativeGroups[$GPO.DomainName]['DomainAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+                $Principal = $ADAdministrativeGroups[$ForestInformation.Forest.RootDomain]['EnterpriseAdmins']
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'WellKnownAdministrative') {
+                $Principal = 'S-1-5-18'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (SYSTEM) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (SYSTEM) with error: $($_.Exception.Message)"
+                    }
+                }
+            } elseif ($Type -eq 'AuthenticatedUsers') {
+                $Principal = 'S-1-5-11'
+                Write-Verbose "Add-GPOZaurrPermission - Adding permission $PermissionType for $($Principal) to $($GPO.DisplayName) at $($GPO.DomainName)"
+                if ($PSCmdlet.ShouldProcess($GPO.DisplayName, "Adding $Principal (Authenticated Users) / $PermissionType to $($GPO.DisplayName) at $($GPO.DomainName)")) {
+                    try {
+                        $AddPermission = [Microsoft.GroupPolicy.GPPermission]::new($Principal, $PermissionType, $Inheritable.IsPresent)
+                        $GPO.GPOSecurity.Add($AddPermission)
+                        $GPO.GPOObject.SetSecurityInfo($GPO.GPOSecurity)
+                    } catch {
+                        Write-Warning "Add-GPOZaurrPermission - Adding permission $PermissionType failed for $($Principal) (Authenticated Users) with error: $($_.Exception.Message)"
+                    }
+                }
+            }
+        }
+
+    }
+}

Public/Get-GPOZaurr.ps1

@@ -11,9 +11,16 @@
         [string[]] $GPOPath,
 
         [switch] $PermissionsOnly,
-        [switch] $Limited
+        [switch] $OwnerOnly,
+        [switch] $Limited,
+
+        [System.Collections.IDictionary] $ADAdministrativeGroups
     )
     Begin {
+        if (-not $ADAdministrativeGroups) {
+            Write-Verbose "Get-GPOZaurr - Getting ADAdministrativeGroups"
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
         if (-not $GPOPath) {
             $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         }
@@ -26,8 +33,13 @@
                     Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
                         Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
                         if (-not $Limited) {
-                            $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                            Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent
+                            try {
+                                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
+                            } catch {
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
+                                continue
+                            }
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
                         } else {
                             $_
                         }
@@ -36,8 +48,13 @@
                     Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object {
                         Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
                         if (-not $Limited) {
-                            $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                            Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent
+                            try {
+                                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
+                            } catch {
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
+                                continue
+                            }
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
                         } else {
                             $_
                         }
@@ -46,8 +63,13 @@
                     Get-GPO -All -Server $QueryServer -Domain $Domain -ErrorAction SilentlyContinue | ForEach-Object {
                         Write-Verbose "Get-GPOZaurr - Getting GPO $($_.DisplayName) / ID: $($_.ID) from $Domain"
                         if (-not $Limited) {
-                            $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain
-                            Get-XMLGPO -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent
+                            try {
+                                $XMLContent = Get-GPOReport -ID $_.ID -ReportType XML -Server $ForestInformation.QueryServers[$Domain].HostName[0] -Domain $Domain -ErrorAction Stop
+                            } catch {
+                                Write-Warning "Get-GPOZaurr - Failed to get GPOReport: $($_.Exception.Message). Skipping."
+                                continue
+                            }
+                            Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -GPO $_ -PermissionsOnly:$PermissionsOnly.IsPresent -ADAdministrativeGroups $ADAdministrativeGroups
                         } else {
                             $_
                         }
@@ -59,7 +81,7 @@
                 Get-ChildItem -LiteralPath $Path -Recurse -Filter *.xml | ForEach-Object {
                     $XMLContent = [XML]::new()
                     $XMLContent.Load($_.FullName)
-                    Get-XMLGPO -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
+                    Get-XMLGPO -OwnerOnly:$OwnerOnly.IsPresent -XMLContent $XMLContent -PermissionsOnly:$PermissionsOnly.IsPresent
                 }
             }
         }

Public/Get-GPOZaurrAD.ps1

@@ -0,0 +1,72 @@
+function Get-GPOZaurrAD {
+    [cmdletbinding(DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')]
+        [string] $GPOName,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            if ($PSCmdlet.ParameterSetName -eq 'GPOGUID') {
+                if ($GPOGuid) {
+                    if ($GPOGUID -notlike '*{*') {
+                        $GUID = -join ("{", $GPOGUID, '}')
+                    } else {
+                        $GUID = $GPOGUID
+                    }
+                    $Splat = @{
+                        Filter = "(objectClass -eq 'groupPolicyContainer') -and (Name -eq '$GUID')"
+                        Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                    }
+                } else {
+                    Write-Warning "Get-GPOZaurrAD - GPOGUID parameter is empty. Provide name and try again."
+                    continue
+                }
+            } elseif ($PSCmdlet.ParameterSetName -eq 'GPOName') {
+                if ($GPOName) {
+                    $Splat = @{
+                        Filter = "(objectClass -eq 'groupPolicyContainer') -and (DisplayName -eq '$GPOName')"
+                        Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                    }
+                } else {
+                    Write-Warning "Get-GPOZaurrAD - GPOName parameter is empty. Provide name and try again."
+                    continue
+                }
+            } else {
+                $Splat = @{
+                    Filter = "(objectClass -eq 'groupPolicyContainer')"
+                    Server = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                }
+            }
+            Get-ADObject @Splat -Properties DisplayName, Name, Created, Modified, gPCFileSysPath, gPCFunctionalityVersion, gPCWQLFilter, gPCMachineExtensionNames, Description, CanonicalName, DistinguishedName | ForEach-Object -Process {
+                $DomainCN = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDomainCN
+                $Output = [ordered]@{ }
+                $Output['DisplayName'] = $_.DisplayName
+                $Output['DomainName'] = $DomainCN
+                $Output['Description'] = $_.Description
+                $Output['GUID'] = $_.Name -replace '{' -replace '}'
+                $Output['Path'] = $_.gPCFileSysPath
+                $Output['FunctionalityVersion'] = $_.gPCFunctionalityVersion
+                $Output['Created'] = $_.Created
+                $Output['Modified'] = $_.Modified
+                $Output['GPOCanonicalName'] = $_.CanonicalName
+                $Output['GPODomainDistinguishedName'] = ConvertFrom-DistinguishedName -DistinguishedName $_.DistinguishedName -ToDC
+                $Output['GPODistinguishedName'] = $_.DistinguishedName
+                [PSCustomObject] $Output
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrBackupInformation.ps1

@@ -11,15 +11,15 @@
             if ($Folder) {
                 if ((Test-Path -LiteralPath "$Folder\manifest.xml")) {
                     [xml] $Xml = Get-Content -LiteralPath "$Folder\manifest.xml"
-                    $Xml.Backups.BackupInst | ForEach-Object {
+                    $Xml.Backups.BackupInst | ForEach-Object -Process {
                         [PSCustomObject] @{
                             DisplayName      = $_.GPODisplayName.'#cdata-section'
                             DomainName       = $_.GPODomain.'#cdata-section'
-                            Guid             = $_.GPOGUid.'#cdata-section'
-                            DomainGuid       = $_.GPODomainGuid.'#cdata-section'
+                            Guid             = $_.GPOGUid.'#cdata-section' -replace '{' -replace '}'
+                            DomainGuid       = $_.GPODomainGuid.'#cdata-section' -replace '{' -replace '}'
                             DomainController = $_.GPODomainController.'#cdata-section'
-                            BackupTime       = $_.BackupTime.'#cdata-section'
-                            ID               = $_.ID.'#cdata-section'
+                            BackupTime       = [DateTime]::Parse($_.BackupTime.'#cdata-section')
+                            ID               = $_.ID.'#cdata-section' -replace '{' -replace '}'
                             Comment          = $_.Comment.'#cdata-section'
                         }
                     }

Public/Get-GPOZaurrFiles.ps1

@@ -0,0 +1,31 @@
+function Get-GPOZaurrFiles {
+    [cmdletbinding()]
+    param(
+        [ValidateSet('All', 'Netlogon', 'Sysvol')][string[]] $Type = 'All',
+        [ValidateSet('None', 'MACTripleDES', 'MD5', 'RIPEMD160', 'SHA1', 'SHA256', 'SHA384', 'SHA512')][string] $HashAlgorithm = 'None',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        $Path = @(
+            if ($Type -contains 'All') {
+                "\\$Domain\SYSVOL\$Domain"
+            }
+            if ($Type -contains 'Sysvol') {
+                "\\$Domain\SYSVOL\$Domain\policies"
+            }
+            if ($Type -contains 'NetLogon') {
+                "\\$Domain\NETLOGON"
+            }
+        )
+        Get-ChildItem -Path $Path -ErrorAction SilentlyContinue -Recurse -ErrorVariable err -File | ForEach-Object {
+            Get-FileMetaData -File $_ -Signature -HashAlgorithm $HashAlgorithm
+        }
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrFiles - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+    }
+}

Public/Get-GPOZaurrLegacyFiles.ps1

@@ -0,0 +1,16 @@
+function Get-GPOZaurrLegacyFiles {
+    [cmdletbinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        Get-ChildItem -Path "\\$Domain\SYSVOL\$Domain\policies" -ErrorAction SilentlyContinue -Recurse -Include '*.adm' -ErrorVariable err | Select-Object Name, FullName, CreationTime, LastWriteTime, Attributes
+        foreach ($e in $err) {
+            Write-Warning "Get-GPOZaurrLegacy - $($e.Exception.Message) ($($e.CategoryInfo.Reason))"
+        }
+    }
+}

Public/Get-GPOZaurrLink.ps1

@@ -0,0 +1,235 @@
+function Get-GPOZaurrLink {
+    [cmdletbinding()]
+    param(
+        [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
+        # weirdly enough site doesn't really work this way unless you give it 'CN=Configuration,DC=ad,DC=evotec,DC=xyz' as SearchBase
+        [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
+        [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
+        [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
+
+        [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $Limited,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [System.Collections.IDictionary] $GPOCache,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [alias('ForestName')][string] $Forest,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [string[]] $ExcludeDomains,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    Begin {
+        $CacheReturnedGPOs = [ordered] @{}
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        if (-not $GPOCache -and -not $Limited) {
+            $GPOCache = @{ }
+            # While initially we used $ForestInformation.Domains but the thing is GPOs can be linked to other domains so we need to get them all so we can use cache of it later on even if we're processing just one domain
+            # That's why we use $ForestInformation.Forest.Domains instead
+            foreach ($Domain in $ForestInformation.Forest.Domains) {
+                $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                Get-GPO -All -DomainName $Domain -Server $QueryServer | ForEach-Object {
+                    $GPOCache["$Domain$($_.ID.Guid)"] = $_
+                }
+            }
+        }
+    }
+    Process {
+        if (-not $ADObject) {
+            if ($Linked) {
+                foreach ($Domain in $ForestInformation.Domains) {
+                    $Splat = @{
+                        #Filter     = $Filter
+                        Properties = 'distinguishedName', 'gplink', 'CanonicalName'
+                        # Filter     = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')"
+                        Server     = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                    }
+                    if ($Linked -contains 'DomainControllers') {
+                        $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']
+                        #if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        #    continue
+                        #}
+                        $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
+                        $Splat['SearchBase'] = $SearchBase
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if ($Linked -contains 'Root') {
+                        $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
+                        #if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        #    continue
+                        # }
+                        $Splat['Filter'] = "objectClass -eq 'domainDNS'"
+                        $Splat['SearchBase'] = $SearchBase
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            foreach ($OutputGPO in $OutputGPOs) {
+                                if (-not $SkipDuplicates) {
+                                    $OutputGPO
+                                } else {
+                                    $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                    if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                        $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                        $OutputGPO
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    if ($Linked -contains 'Site') {
+                        # Sites are defined only in primary domain
+                        if ($ForestInformation['DomainsExtended'][$Domain]['DNSRoot'] -eq $ForestInformation['DomainsExtended'][$Domain]['Forest']) {
+                            $SearchBase = -join ("CN=Configuration,", $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName'])
+                            # if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                            # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                            #continue
+                            #}
+                            $Splat['Filter'] = "(objectClass -eq 'site')"
+                            $Splat['SearchBase'] = $SearchBase
+                            try {
+                                $ADObjectGPO = Get-ADObject @Splat
+                            } catch {
+                                Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                            }
+                            foreach ($_ in $ADObjectGPO) {
+                                Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                            }
+                        }
+                    }
+                    if ($Linked -contains 'Other') {
+                        $SearchBase = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
+                        #if ($SearchBase -notlike "*$DomainDistinguishedName") {
+                        # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                        #    continue
+                        #}
+                        $Splat['Filter'] = "(objectClass -eq 'organizationalUnit')"
+                        $Splat['SearchBase'] = $SearchBase
+                        try {
+                            $ADObjectGPO = Get-ADObject @Splat
+                        } catch {
+                            Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                        }
+                        foreach ($_ in $ADObjectGPO) {
+                            if ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']) {
+                                # other skips Domain Root
+                            } elseif ($_.DistinguishedName -eq $ForestInformation['DomainsExtended'][$Domain]['DomainControllersContainer']) {
+                                # other skips Domain Controllers
+                            } else {
+                                $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                                foreach ($OutputGPO in $OutputGPOs) {
+                                    if (-not $SkipDuplicates) {
+                                        $OutputGPO
+                                    } else {
+                                        $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                        if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                            $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                            $OutputGPO
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            } else {
+                foreach ($Domain in $ForestInformation.Domains) {
+                    $Splat = @{
+                        Filter     = $Filter
+                        Properties = 'distinguishedName', 'gplink', 'CanonicalName'
+                        Server     = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+
+                    }
+                    if ($PSBoundParameters.ContainsKey('SearchBase')) {
+                        $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain]['DistinguishedName']
+                        $SearchBaseDC = ConvertFrom-DistinguishedName -DistinguishedName $SearchBase -ToDC
+                        if ($SearchBaseDC -ne $DomainDistinguishedName) {
+                            # we check if SearchBase is part of domain distinugishname. If it isn't we skip
+                            continue
+                        }
+                        $Splat['SearchBase'] = $SearchBase
+
+                    }
+                    if ($PSBoundParameters.ContainsKey('SearchScope')) {
+                        $Splat['SearchScope'] = $SearchScope
+                    }
+
+                    try {
+                        $ADObjectGPO = Get-ADObject @Splat
+                    } catch {
+                        Write-Warning "Get-GPOZaurrLink - Get-ADObject error $($_.Exception.Message)"
+                    }
+                    foreach ($_ in $ADObjectGPO) {
+                        $OutputGPOs = Get-PrivGPOZaurrLink -Object $_ -Limited:$Limited.IsPresent -GPOCache $GPOCache
+                        foreach ($OutputGPO in $OutputGPOs) {
+                            if (-not $SkipDuplicates) {
+                                $OutputGPO
+                            } else {
+                                $UniqueGuid = -join ($OutputGPO.DomainName, $OutputGPO.Guid)
+                                if (-not $CacheReturnedGPOs[$UniqueGuid]) {
+                                    $CacheReturnedGPOs[$UniqueGuid] = $OutputGPO
+                                    $OutputGPO
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        } else {
+            foreach ($Object in $ADObject) {
+                Get-PrivGPOZaurrLink -Object $Object -Limited:$Limited.IsPresent -GPOCache $GPOCache
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrLinkSummary.ps1

@@ -0,0 +1,164 @@
+function Get-GPOZaurrLinkSummary {
+    [cmdletBinding()]
+    param(
+        [ValidateSet('All', 'MultipleLinks', 'OneLink', 'LinksSummary')][string[]] $Report = 'All',
+        [switch] $UnlimitedProperties,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    $HighestCount = 0 # to keep number of depth
+    $CacheSummaryLinks = [ordered] @{} # cache
+
+    # Get all links
+    $Links = Get-GPOZaurrLink -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Link in $Links) {
+        if (-not $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"]) {
+            $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"] = [System.Collections.Generic.List[System.Object]]::new()
+        }
+        $CacheSummaryLinks["$($Link.DomainName)$($Link.Guid)"].Add($Link)
+    }
+
+    $ReturnObject = [ordered] @{
+        MultipleLinks = [System.Collections.Generic.List[System.Object]]::new()
+        OneLink       = [System.Collections.Generic.List[System.Object]]::new()
+        LinksSummary  = [System.Collections.Generic.List[System.Object]]::new()
+    }
+
+    foreach ($Key in $CacheSummaryLinks.Keys) {
+        $GPOs = $CacheSummaryLinks[$Key]
+
+        [Array] $LinkingSummary = foreach ($GPO in $GPOs) {
+            $SplitttedOU = ($GPO.DistinguishedName -split ',')
+            [Array] $Clean = foreach ($_ in $SplitttedOU) {
+                if ($_ -notlike 'DC=*') { $_ -replace 'OU=' }
+            }
+            if ($Clean.Count -gt $HighestCount) {
+                $HighestCount = $Clean.Count
+            }
+            if ($Clean) {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = ConvertFrom-DistinguishedName -DistinguishedName $GPO.DistinguishedName -ToDomainCN
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $Clean[ - $i]
+                }
+                [PSCustomobject] $Test
+            } else {
+                $Test = [ordered] @{
+                    DisplayName = $GPO.DisplayName
+                    Guid        = $GPO.Guid
+                    DomainName  = $GPO.DomainName
+                    Level0      = $GPO.CanonicalName
+                }
+                for ($i = 1; $i -le 10; $i++) {
+                    $Test["Level$i"] = $null
+                }
+                [PSCustomobject] $Test
+            }
+        }
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            foreach ($Link in $LinkingSummary) {
+                $ReturnObject.MultipleLinks.Add($Link)
+            }
+            #continue
+        }
+        if ($Report -eq 'OneLink' -or $Report -contains 'All') {
+            $List = [ordered] @{
+                DisplayName = $GPOs[0].DisplayName
+                Guid        = $GPOs[0].Guid
+                DomainName  = $GPOs[0].DomainName
+                LinksCount  = $GPOs.Count
+            }
+            for ($i = 0; $i -le 10; $i++) {
+                $List["Level$i"] = ($LinkingSummary."Level$i" | Select-Object -Unique).Count
+                $List["Level$($i)List"] = ($LinkingSummary."Level$i" | Select-Object -Unique)
+            }
+            $List.LinksDistinguishedName = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+            $List.LinksCanonicalName = $GPOs.CanonicalName
+
+            $List.Owner = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+            $List.GpoStatus = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+            $List.Description = $GPOs[0].Description                #:
+            $List.CreationTime = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+            $List.ModificationTime = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+            $List.GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+            $List.GPODistinguishedName = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+
+            $ReturnObject.OneLink.Add( [PSCustomObject] $List)
+        }
+        if ($Report -eq 'LinksSummary' -or $Report -contains 'All') {
+            $Output = [PSCustomObject] @{
+                DisplayName                = $GPOs[0].DisplayName                #: COMPUTERS | LAPS
+                Guid                       = $GPOs[0].Guid                       #: AA782787 - 002B-4B8C-886F-05873F2DC0CA
+                DomainName                 = $GPOs[0].DomainName                 #: ad.evotec.xyz
+                LinksCount                 = $GPOs.Count
+                LinksDistinguishedName     = $GPOs.DistinguishedName          # = Computers, OU = ITR02, DC = ad, DC = evotec, DC = xyz
+                LinksCanonicalName         = $GPOs.CanonicalName              #: ad.evotec.xyz / ITR02 / Computers
+                Owner                      = $GPOs[0].Owner                      #: EVOTEC\Domain Admins
+                GpoStatus                  = $GPOs[0].GpoStatus                  #: AllSettingsEnabled
+                Description                = $GPOs[0].Description                #:
+                CreationTime               = $GPOs[0].CreationTime               #: 16.12.2019 21:25:32
+                ModificationTime           = $GPOs[0].ModificationTime           #: 30.05.2020 19:12:58
+                GPODomainDistinguishedName = $GPOs[0].GPODomainDistinguishedName #: DC = ad, DC = evotec, DC = xyz
+                GPODistinguishedName       = $GPOs[0].GPODistinguishedName       #: cn = { AA782787 - 002B-4B8C-886F-05873F2DC0CA }, cn = policies, cn = system, DC = ad, DC = evotec, DC = xy
+            }
+            $ReturnObject.LinksSummary.Add($Output)
+        }
+    }
+    # Processing output
+    if (-not $UnlimitedProperties) {
+        if ($Report -contains 'MultipleLinks' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                }
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.MultipleLinks = $ReturnObject.MultipleLinks | Select-Object -Property $Properties
+        }
+        if ($Report -contains 'OneLink' -or $Report -contains 'All') {
+            $Properties = @(
+                'DisplayName'
+                'DomainName'
+                'GUID'
+                for ($i = 0; $i -le $HighestCount; $i++) {
+                    "Level$i"
+                    "Level$($i)List"
+                }
+                'LinksDistinguishedName'
+                'LinksCanonicalName'
+                'Owner'
+                'GpoStatus'
+                'Description'
+                'CreationTime'
+                'ModificationTime'
+                'GPODomainDistinguishedName'
+                'GPODistinguishedName'
+            )
+            $ReturnObject.OneLink = $ReturnObject.OneLink | Select-Object -Property $Properties
+        }
+        #if ($Report -contains 'LinksSummary' -or $Report -contains 'All') {
+        # Not needed because there's no dynamic properties, but if there would be we need to uncomment and fix it
+        #}
+    }
+    if ($Report.Count -eq 1 -and $Report -notcontains 'All') {
+        $ReturnObject["$Report"]
+    } else {
+        $ReturnObject
+    }
+}

Public/Get-GPOZaurrOwner.ps1

@@ -0,0 +1,60 @@
+function Get-GPOZaurrOwner {
+    [cmdletbinding(DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [switch] $IncludeSysvol,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        if (-not $ADAdministrativeGroups) {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
+    }
+    Process {
+        $getGPOZaurrADSplat = @{
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ForestInformation
+        }
+        if ($GPOName) {
+            $getGPOZaurrADSplat['GPOName'] = $GPOName
+        } elseif ($GPOGuid) {
+            $getGPOZaurrADSplat['GPOGUID'] = $GPOGuid
+        }
+        $Objects = Get-GPOZaurrAD @getGPOZaurrADSplat
+        foreach ($_ in $Objects) {
+            Write-Verbose "Get-GPOZaurrOwner - Processing GPO: $($_.DisplayName) from domain: $($_.DomainName)"
+            $ACL = Get-ADACLOwner -ADObject $_.GPODistinguishedName -Resolve -ADAdministrativeGroups $ADAdministrativeGroups
+            $Object = [ordered] @{
+                DisplayName = $_.DisplayName
+                DomainName  = $_.DomainName
+                GUID        = $_.GUID
+                Owner       = $ACL.OwnerName
+                OwnerSid    = $ACL.OwnerSid
+                OwnerType   = $ACL.OwnerType
+            }
+            if ($IncludeSysvol) {
+                $FileOwner = Get-FileOwner -JustPath -Path $_.Path -Resolve
+                $Object['SysvolOwner'] = $FileOwner.OwnerName
+                $Object['SysvolSid'] = $FileOwner.OwnerSid
+                $Object['SysvolType'] = $FileOwner.OwnerType
+                $Object['SysvolPath'] = $_.Path
+                $Object['IsOwnerConsistent'] = if ($ACL.OwnerName -eq $FileOwner.OwnerName) { $true } else { $false }
+            }
+            $Object['DistinguishedName'] = $_.GPODistinguishedName
+            [PSCUstomObject] $Object
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrPassword.ps1

@@ -14,7 +14,7 @@
             $ForestInformation = $ExtendedForestInformation
         }
 
-        $GPOPath = foreach ($Domain in $ForestInformation.Domains) {
+        [Array] $GPOPath = foreach ($Domain in $ForestInformation.Domains) {
             -join ('\\', $Domain, '\SYSVOL\', $Domain, '\Policies')
         }
     }

Public/Get-GPOZaurrPermission.ps1

@@ -7,45 +7,138 @@
         [Parameter(ParameterSetName = 'GPOGUID')]
         [alias('GUID', 'GPOID')][string] $GPOGuid,
 
-        [validateSet('Unknown', 'All')][string[]] $Type = 'All',
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [validateSet('AuthenticatedUsers', 'DomainComputers', 'Unknown', 'WellKnownAdministrative', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'Administrative', 'All')][string[]] $Type = 'All',
 
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
+        [switch] $ResolveAccounts,
 
         [switch] $IncludeOwner,
         [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'All',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid',
+
         [switch] $IncludeGPOObject,
 
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
-        [System.Collections.IDictionary] $ExtendedForestInformation
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [System.Collections.IDictionary] $ADAdministrativeGroups,
+        [switch] $ReturnSecurityWhenNoData # if no data return all data
     )
     Begin {
-        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+        if (-not $ADAdministrativeGroups) {
+            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        }
         if ($Type -eq 'Unknown') {
             if ($SkipAdministrative -or $SkipWellKnown) {
                 Write-Warning "Get-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
             }
         }
+        if ($ResolveAccounts) {
+            $Accounts = @{ }
+            foreach ($Domain in $ForestInformation.Domains) {
+                $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+                $DomainInformation = Get-ADDomain -Server $QueryServer
+                $Users = Get-ADUser -Filter * -Server $QueryServer -Properties PasswordLastSet, LastLogonDate, UserPrincipalName
+                foreach ($User in $Users) {
+                    $U = -join ($DomainInformation.NetBIOSName, '\', $User.SamAccountName)
+                    $Accounts[$U] = $User
+                }
+                $Groups = Get-ADGroup -Filter * -Server $QueryServer
+                foreach ($Group in $Groups) {
+                    $G = -join ($DomainInformation.NetBIOSName, '\', $Group.SamAccountName)
+                    $Accounts[$G] = $Group
+                }
+            }
+        }
     }
     Process {
-        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
         foreach ($Domain in $ForestInformation.Domains) {
             $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
             if ($GPOName) {
-                Get-GPO -Name $GPOName -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / Name: $GPOName) with:"
             } elseif ($GPOGuid) {
-                Get-GPO -Guid $GPOGuid -Domain $Domain -Server $QueryServer -ErrorAction SilentlyContinue | ForEach-Object -Process {
-                    Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / GUID: $GPOGuid) with:"
             } else {
-                Get-GPO -All -Domain $Domain -Server $QueryServer | ForEach-Object -Process {
-                    Get-PrivPermission -Type $Type -GPO $_ -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent -IncludeOwner:$IncludeOwner.IsPresent -IncludeGPOObject:$IncludeGPOObject.IsPresent -IncludePermissionType $IncludePermissionType -ExcludePermissionType $ExcludePermissionType -ADAdministrativeGroups $ADAdministrativeGroups
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
                 }
+                $TextForError = "Error running Get-GPO (QueryServer: $QueryServer / Domain: $Domain / All: $True) with:"
+            }
+            Try {
+                Get-GPO @getGPOSplat | ForEach-Object -Process {
+                    $GPOSecurity = $_.GetSecurityInfo()
+                    $getPrivPermissionSplat = @{
+                        Principal                 = $Principal
+                        PrincipalType             = $PrincipalType
+                        PermitType                = $PermitType
+                        Accounts                  = $Accounts
+                        Type                      = $Type
+                        GPO                       = $_
+                        SkipWellKnown             = $SkipWellKnown.IsPresent
+                        SkipAdministrative        = $SkipAdministrative.IsPresent
+                        IncludeOwner              = $IncludeOwner.IsPresent
+                        IncludeGPOObject          = $IncludeGPOObject.IsPresent
+                        IncludePermissionType     = $IncludePermissionType
+                        ExcludePermissionType     = $ExcludePermissionType
+                        ExcludePrincipal          = $ExcludePrincipal
+                        ExcludePrincipalType      = $ExcludePrincipalType
+                        ADAdministrativeGroups    = $ADAdministrativeGroups
+                        ExtendedForestInformation = $ForestInformation
+                        SecurityRights            = $GPOSecurity
+                    }
+                    try {
+                        $Output = Get-PrivPermission @getPrivPermissionSplat
+                    } catch {
+                        $Output = $null
+                        Write-Warning "Get-GPOZaurrPermission - Error running Get-PrivPermission: $($_.Exception.Message)"
+                    }
+                    if (-not $Output) {
+                        if ($ReturnSecurityWhenNoData) {
+                            # there is no data to return, but we need to have GPO information to process ADD permissions.
+                            $ReturnObject = [PSCustomObject] @{
+                                DisplayName      = $_.DisplayName #      : ALL | Enable RDP
+                                GUID             = $_.ID
+                                DomainName       = $_.DomainName  #      : ad.evotec.xyz
+                                Enabled          = $_.GpoStatus
+                                Description      = $_.Description
+                                CreationDate     = $_.CreationTime
+                                ModificationTime = $_.ModificationTime
+                                GPOObject        = $_
+                                GPOSecurity      = $GPOSecurity
+                            }
+                            $ReturnObject
+                        }
+                    } else {
+                        $Output
+                    }
+                }
+            } catch {
+                Write-Warning "Get-GPOZaurrPermission - $TextForError $($_.Exception.Message)"
             }
         }
     }

Public/Get-GPOZaurrPermissionConsistency.ps1

@@ -0,0 +1,122 @@
+function Get-GPOZaurrPermissionConsistency {
+    [cmdletBinding(DefaultParameterSetName = 'Type')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+        [Parameter(ParameterSetName = 'Type')][validateSet('Consistent', 'Inconsistent', 'All')][string[]] $Type = 'All',
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $IncludeGPOObject,
+        [switch] $VerifyInheritance
+    )
+    Begin {
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+            if ($GPOName) {
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } elseif ($GPOGuid) {
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } else {
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            }
+            Get-GPO @getGPOSplat | ForEach-Object -Process {
+                try {
+                    $IsConsistent = $_.IsAclConsistent()
+                    $ErrorMessage = ''
+                } catch {
+                    $ErrorMessage = $_.Exception.Message
+                    Write-Warning "Get-GPOZaurrPermissionConsistency - Failed to get consistency: $($_.Exception.Message)."
+                    $IsConsistent = 'Not available.'
+                }
+                $SysVolpath = -join ('\\', $Domain, '\sysvol\', $Domain, '\Policies\{', $_.ID.GUID, '}')
+                if ($VerifyInheritance) {
+                    $FolderPermissions = Get-WinADSharePermission -Path $SysVolpath
+                    [Array] $NotInheritedPermissions = foreach ($File in $FolderPermissions) {
+                        if ($File.Path -ne $SysVolpath -and $File.IsInherited -eq $false) {
+                            $File
+                        }
+                    }
+                    if ($NotInheritedPermissions.Count -eq 0) {
+                        $ACLConsistentInside = $true
+                    } else {
+                        $ACLConsistentInside = $false
+                    }
+                } else {
+                    $ACLConsistentInside = $null
+                }
+                $Object = [ordered] @{
+                    DisplayName   = $_.DisplayName     # : New Group Policy Object
+                    DomainName    = $_.DomainName      # : ad.evotec.xyz
+                    ACLConsistent = $IsConsistent
+                }
+                if ($VerifyInheritance) {
+                    $Object['ACLConsistentInside'] = $ACLConsistentInside
+                }
+                $Object['Owner'] = $_.Owner           # : EVOTEC\Enterprise Admins
+                $Object['Path'] = $_.Path
+                $Object['SysVolPath '] = $SysvolPath
+                $Object['Id       '] = $_.Id              # : 8a7bc515-d7fd-4d1f-90b8-e47c15f89295
+                $Object['GpoStatus'] = $_.GpoStatus       # : AllSettingsEnabled
+                $Object['Description'] = $_.Description     # :
+                $Object['CreationTime'] = $_.CreationTime    # : 04.03.2020 17:19:42
+                $Object['ModificationTime'] = $_.ModificationTime# : 06.05.2020 10:30:36
+                $Object['UserVersion'] = $_.UserVersion     # : AD Version: 0, SysVol Version: 0
+                $Object['ComputerVersion'] = $_.ComputerVersion # : AD Version: 1, SysVol Version: 1
+                $Object['WmiFilter'] = $_.WmiFilter       # :
+                $Object['Error'] = $ErrorMessage
+                if ($IncludeGPOObject) {
+                    $Object['IncludeGPOObject'] = $_
+                }
+                if ($VerifyInheritance) {
+                    $Object['ACLConsistentInsideDetails'] = $NotInheritedPermissions
+                }
+                if ($Type -eq 'All') {
+                    [PSCustomObject] $Object
+                } elseif ($Type -eq 'Inconsistent') {
+                    if ($VerifyInheritance) {
+                        if (-not $IsConsistent -or -not $ACLConsistentInside) {
+                            [PSCustomObject] $Object
+                        }
+                    } else {
+                        if (-not $IsConsistent) {
+                            [PSCustomObject] $Object
+                        }
+                    }
+                } elseif ($Type -eq 'Consistent') {
+                    if ($VerifyInheritance) {
+                        if ($IsConsistent -and $ACLConsistentInside) {
+                            [PSCustomObject] $Object
+                        }
+                    } else {
+                        if ($IsConsistent) {
+                            [PSCustomObject] $Object
+                        }
+                    }
+                }
+            }
+        }
+    }
+    End {
+
+    }
+}

Public/Get-GPOZaurrSysvol.ps1

@@ -0,0 +1,37 @@
+function Get-GPOZaurrSysvol {
+    [cmdletBinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [string[]] $ExcludeDomainControllers,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [alias('DomainControllers')][string[]] $IncludeDomainControllers,
+        [switch] $SkipRODC,
+        [Array] $GPOs,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+        [switch] $VerifyDomainControllers
+    )
+    $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExcludeDomainControllers $ExcludeDomainControllers -IncludeDomainControllers $IncludeDomainControllers -SkipRODC:$SkipRODC -ExtendedForestInformation $ExtendedForestInformation
+    foreach ($Domain in $ForestInformation.Domains) {
+        Write-Verbose "Get-WinADGPOSysvolFolders - Processing $Domain"
+        $QueryServer = $ForestInformation['QueryServers']["$Domain"].HostName[0]
+        Try {
+            [Array]$GPOs = Get-GPO -All -Domain $Domain -Server $QueryServer
+        } catch {
+            Write-Warning "Get-GPOZaurrSysvol - Couldn't get GPOs from $Domain. Error: $($_.Exception.Message)"
+            continue
+        }
+        if ($GPOs.Count -ge 2) {
+            if (-not $VerifyDomainControllers) {
+                Test-SysVolFolders -GPOs $GPOs -Server $Domain -Domain $Domain
+            } else {
+                foreach ($Server in $ForestInformation['DomainDomainControllers']["$Domain"]) {
+                    Write-Verbose "Get-GPOZaurrSysvol - Processing $Domain \ $($Server.HostName.Trim())"
+                    Test-SysVolFolders -GPOs $GPOs -Server $Server.Hostname -Domain $Domain
+                }
+            }
+        } else {
+            Write-Warning "Get-GPOZaurrSysvol - GPO count for $Domain is less then 2. This is not expected for fully functioning domain. Skipping processing SYSVOL folder."
+        }
+    }
+}

Public/Get-GPOZaurrWmi.ps1

@@ -1,4 +1,11 @@
-function Get-GPOZaurrWMI {
+function Get-WMIFilter {
+    param(
+
+    )
+
+}
+
+function Get-GPOZaurrWMI {
     [cmdletBinding()]
     Param(
         [Guid[]] $Guid,
@@ -13,79 +20,63 @@
     $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
     foreach ($Domain in $ForestInformation.Domains) {
         $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
-        if ($Guid -or $Name) {
-            foreach ($N in $Name) {
-                try {
-                    $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))"
-                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
-                        $WMI = $_.'msWMI-Parm2' -split ';'
-                        [PSCustomObject] @{
-                            DisplayName              = $_.'msWMI-Name'
-                            Description       = $_.'msWMI-Parm1'
-                            DomainName            = $Domain
-                            NameSpace         = $WMI[5]
-                            Query             = $WMI[6]
-                            Author            = $_.'msWMI-Author'
-                            ID                = $_.'msWMI-ID'
-                            Created           = $_.Created
-                            Modified          = $_.Modified
-                            ObjectGUID        = $_.'ObjectGUID'
-                            CanonicalName     = $_.CanonicalName
-                            DistinguishedName = $_.'DistinguishedName'
-                        }
+        $Objects = @(
+            if ($Name) {
+                foreach ($N in $Name) {
+                    try {
+                        $ldapFilter = "(&(objectClass=msWMI-Som)(msWMI-Name=$N))"
+                        Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer
+                    } catch {
+                        Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
                     }
+                }
+            } elseif ($GUID) {
+                foreach ($G in $GUID) {
+                    try {
+                        $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))"
+                        Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer
+                    } catch {
+                        Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+                    }
+                }
+            } else {
+                try {
+                    $ldapFilter = "(objectClass=msWMI-Som)"
+                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer
                 } catch {
                     Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
                 }
             }
-            foreach ($G in $GUID) {
-                $ldapFilter = "(&(objectClass=msWMI-Som)(Name={$G}))"
-                try {
-                    Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
-                        $WMI = $_.'msWMI-Parm2' -split ';'
-                        [PSCustomObject] @{
-                            DisplayName              = $_.'msWMI-Name'
-                            Description       = $_.'msWMI-Parm1'
-                            DomainName            = $Domain
-                            NameSpace         = $WMI[5]
-                            Query             = $WMI[6]
-                            Author            = $_.'msWMI-Author'
-                            ID                = $_.'msWMI-ID'
-                            Created           = $_.Created
-                            Modified          = $_.Modified
-                            ObjectGUID        = $_.'ObjectGUID'
-                            CanonicalName     = $_.CanonicalName
-                            DistinguishedName = $_.'DistinguishedName'
-                        }
-                    }
-                } catch {
-                    Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+        )
+        foreach ($_ in $Objects) {
+            $WMI = $_.'msWMI-Parm2' -split ';' #$WMI = $_.'msWMI-Parm2'.Split(';',8)
+            [Array] $Data = for ($i = 0; $i -lt $WMI.length; $i += 6) {
+                if ($WMI[$i + 5]) {
+                    #[PSCustomObject] @{
+                    #    NameSpace = $WMI[$i + 5]
+                    #    Query     = $WMI[$i + 6]
+                    #}
+                    -join ($WMI[$i + 5], ';' , $WMI[$i + 6])
                 }
             }
-        } else {
-            $ldapFilter = "(objectClass=msWMI-Som)"
-            try {
-                Get-ADObject -LDAPFilter $ldapFilter -Properties $wmiFilterAttr -Server $QueryServer | ForEach-Object -Process {
-                    $WMI = $_.'msWMI-Parm2' -split ';'
-                    [PSCustomObject] @{
-                        DisplayName              = $_.'msWMI-Name'
-                        Description       = $_.'msWMI-Parm1'
-                        DomainName            = $Domain
-                        NameSpace         = $WMI[5]
-                        Query             = $WMI[6]
-                        Author            = $_.'msWMI-Author'
-                        ID                = $_.'msWMI-ID'
-                        Created           = $_.Created
-                        Modified          = $_.Modified
-                        ObjectGUID        = $_.'ObjectGUID'
-                        CanonicalName     = $_.CanonicalName
-                        DistinguishedName = $_.'DistinguishedName'
-                    }
-                }
-            } catch {
-                Write-Warning "Get-GPOZaurrWMI - Error processing WMI for $Domain`: $($_.Error.Exception)"
+            [PSCustomObject] @{
+                DisplayName       = $_.'msWMI-Name'
+                Description       = $_.'msWMI-Parm1'
+                DomainName        = $Domain
+                #NameSpace         = $WMI[$i + 5]
+                #Query             = $WMI[$i + 6]
+                QueryCount        = $Data.Count
+                Query             = $Data -join ","
+                Author            = $_.'msWMI-Author'
+                ID                = $_.'msWMI-ID'
+                Created           = $_.Created
+                Modified          = $_.Modified
+                ObjectGUID        = $_.'ObjectGUID'
+                CanonicalName     = $_.CanonicalName
+                DistinguishedName = $_.'DistinguishedName'
             }
         }
+
     }
 }
 <#

Public/Invoke-GPOZaurrPermission.ps1

@@ -0,0 +1,278 @@
+function Invoke-GPOZaurrPermission {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [parameter(Position = 0)]
+        [scriptblock] $PermissionRules,
+
+        # ParameterSet1
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+
+        # ParameterSet2
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        # ParameterSet3
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Level,
+        [parameter(ParameterSetName = 'Level', Mandatory)][int] $Limit,
+
+        # ParameterSet4
+        [parameter(ParameterSetName = 'Linked', Mandatory)][validateset('Root', 'DomainControllers', 'Site', 'Other')][string] $Linked,
+
+        # ParameterSet5
+        [parameter(ParameterSetName = 'ADObject', ValueFromPipeline, ValueFromPipelineByPropertyName, Mandatory)][Microsoft.ActiveDirectory.Management.ADObject[]] $ADObject,
+
+        # ParameterSet6
+        [parameter(ParameterSetName = 'Filter')][string] $Filter = "(objectClass -eq 'organizationalUnit' -or objectClass -eq 'domainDNS' -or objectClass -eq 'site')",
+        [parameter(ParameterSetName = 'Filter')][string] $SearchBase,
+        [parameter(ParameterSetName = 'Filter')][Microsoft.ActiveDirectory.Management.ADSearchScope] $SearchScope,
+
+        # All other paramerrs are for for all parametersets
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'NotAdministrative', 'All')][string[]] $Type,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [Array] $ApprovedGroups,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [alias('Principal')][Array] $Trustee,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [Microsoft.GroupPolicy.GPPermissionType] $TrusteePermissionType,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [alias('PrincipalType')][validateset('DistinguishedName', 'Name', 'Sid')][string] $TrusteeType = 'DistinguishedName',
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [System.Collections.IDictionary] $GPOCache,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [alias('ForestName')][string] $Forest,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [string[]] $ExcludeDomains,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [parameter(ParameterSetName = 'Level')]
+        [switch] $LimitAdministrativeGroupsToDomain,
+
+        [Parameter(ParameterSetName = 'GPOGUID')]
+        [Parameter(ParameterSetName = 'GPOName')]
+        [parameter(ParameterSetName = 'Filter')]
+        [parameter(ParameterSetName = 'ADObject')]
+        [parameter(ParameterSetName = 'Linked')]
+        [switch] $SkipDuplicates
+    )
+    if ($PermissionRules) {
+        $Rules = & $PermissionRules
+    } else {
+        Write-Warning "Invoke-GPOZaurrPermission - No rules defined. Stopping processing."
+        return
+    }
+    $ForestInformation = Get-WinADForestDetails -Extended -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+    if ($LimitAdministrativeGroupsToDomain) {
+        # This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    } else {
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest #-IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+    }
+    if ($PSCmdlet.ParameterSetName -ne 'Level') {
+        $Splat = @{
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ForestInformation
+            SkipDuplicates            = $SkipDuplicates.IsPresent
+        }
+        if ($ADObject) {
+            $Splat['ADObject'] = $ADObject
+        } elseif ($Linked) {
+            $Splat['Linked'] = $Linked
+        } elseif ($GPOName) {
+
+        } elseif ($GPOGuid) {
+
+        } else {
+            if ($Filter) {
+                $Splat['Filter'] = $Filter
+            }
+            if ($SearchBase) {
+                $Splat['SearchBase'] = $SearchBase
+            }
+            if ($SearchScope) {
+                $Splat['SearchScope'] = $SearchScope
+            }
+        }
+
+
+
+        Get-GPOZaurrLink @Splat | ForEach-Object -Process {
+            $GPO = $_
+            foreach ($Rule in $Rules) {
+                if ($Rule.Action -eq 'Owner') {
+                    if ($Rule.Type -eq 'Administrative') {
+                        # We check for Owner (sometimes it can be empty)
+                        if ($GPO.Owner) {
+                            $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                        } else {
+                            $AdministrativeGroup = $null
+                        }
+                        if (-not $AdministrativeGroup) {
+                            $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Type -eq 'Default') {
+                        Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                        #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                        Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                    }
+                } elseif ($Rule.Action -eq 'Remove') {
+                    $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
+                    foreach ($Permission in $GPOPermissions) {
+                        Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                    }
+                } elseif ($Rule.Action -eq 'Add') {
+                    # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                    $SplatPermissions = @{
+                        #Forest                    = $Forest
+                        IncludeDomains         = $GPO.DomainName
+                        #ExcludeDomains            = $ExcludeDomains
+                        #ExtendedForestInformation = $ForestInformation
+
+                        GPOGuid                = $GPO.GUID
+                        IncludePermissionType  = $Rule.IncludePermissionType
+                        Type                   = $Rule.Type
+                        PermitType             = $Rule.PermitType
+                        Principal              = $Rule.Principal
+                        ADAdministrativeGroups = $ADAdministrativeGroups
+                    }
+                    if ($Rule.PrincipalType) {
+                        $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                    }
+                    Add-GPOZaurrPermission @SplatPermissions
+                }
+            }
+        }
+    } else {
+        # This is special case based on different command
+        $Report = Get-GPOZaurrLinkSummary -Report OneLink
+        $AffectedGPOs = foreach ($GPO in $Report) {
+            $Property = "Level$($Level)"
+            if ($GPO."$Property" -gt $Limit) {
+                foreach ($Rule in $Rules) {
+                    if ($Rule.Action -eq 'Owner') {
+                        if ($Rule.Type -eq 'Administrative') {
+                            # We check for Owner (sometimes it can be empty)
+                            if ($GPO.Owner) {
+                                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
+                            } else {
+                                $AdministrativeGroup = $null
+                            }
+                            if (-not $AdministrativeGroup) {
+                                $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
+                                Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
+                                #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $DefaultPrincipal -Verbose:$false -WhatIf:$WhatIfPreference
+                                Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $DefaultPrincipal -WhatIf:$WhatIfPreference
+                            }
+                        } elseif ($Rule.Type -eq 'Default') {
+                            Write-Verbose "Invoke-GPOZaurrPermission - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $($Rule.Principal)"
+                            #Set-ADACLOwner -ADObject $GPO.GPODistinguishedName -Principal $Rule.Principal -Verbose:$false -WhatIf:$WhatIfPreference
+                            Set-GPOZaurrOwner -GPOGuid $GPO.Guid -IncludeDomains $GPO.Domain -Principal $Rule.Principal -WhatIf:$WhatIfPreference
+                        }
+                    } elseif ($Rule.Action -eq 'Remove') {
+                        $GPOPermissions = Get-GPOZaurrPermission -GPOGuid $GPO.GUID -IncludeDomains $GPO.DomainName -IncludePermissionType $Rule.IncludePermissionType -ExcludePermissionType $Rule.ExcludePermissionType -Type $Rule.Type -IncludeGPOObject -PermitType $Rule.PermitType -Principal $Rule.Principal -PrincipalType $Rule.PrincipalType -ExcludePrincipal $Rule.ExcludePrincipal -ExcludePrincipalType $Rule.ExcludePrincipalType -ADAdministrativeGroups $ADAdministrativeGroups
+                        foreach ($Permission in $GPOPermissions) {
+                            Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission
+                        }
+                    } elseif ($Rule.Action -eq 'Add') {
+                        # Initially we were askng for same domain as user requested, but in fact we need to apply GPODomain as it can be linked to different domain
+                        $SplatPermissions = @{
+                            #Forest                    = $Forest
+                            IncludeDomains         = $GPO.DomainName
+                            #ExcludeDomains            = $ExcludeDomains
+                            #ExtendedForestInformation = $ForestInformation
+
+                            GPOGuid                = $GPO.GUID
+                            IncludePermissionType  = $Rule.IncludePermissionType
+                            Type                   = $Rule.Type
+                            PermitType             = $Rule.PermitType
+                            Principal              = $Rule.Principal
+                            ADAdministrativeGroups = $ADAdministrativeGroups
+                        }
+                        if ($Rule.PrincipalType) {
+                            $SplatPermissions.PrincipalType = $Rule.PrincipalType
+                        }
+                        Add-GPOZaurrPermission @SplatPermissions
+                    }
+                }
+            }
+        }
+        $AffectedGPOs
+    }
+}

Public/New-GPOZaurrWMi.ps1

@@ -3,6 +3,7 @@
     param(
         [parameter(Mandatory)][string] $Name,
         [string] $Description = ' ',
+        [string] $Namespace = 'root\CIMv2',
         [parameter(Mandatory)][string] $Query,
         [switch] $SkipQueryCheck,
         [switch] $Force,
@@ -50,7 +51,7 @@
 
         [Array] $ExistingWmiFilter = Get-GPOZaurrWMI -ExtendedForestInformation $ForestInformation -IncludeDomains $Domain -Name $Name
         if ($ExistingWmiFilter.Count -eq 0) {
-            [string] $WMIParm2 = -join ("1;3;10;", $Query.Length.ToString(), ";WQL;root\CIMv2;", $Query , ";")
+            [string] $WMIParm2 = -join ("1;3;10;", $Query.Length.ToString(), ";WQL;$Namespace;", $Query , ";")
             $OtherAttributes = @{
                 "msWMI-Name"             = $Name
                 "msWMI-Parm1"            = $Description
@@ -67,7 +68,7 @@
 
             try {
                 Write-Verbose "New-GPOZaurrWMI - Creating WMI filter $Name in $Domain"
-                New-ADObject -name $GUID -type "msWMI-Som" -Path $WMIPath -OtherAttributes $OtherAttributes -Server $QueryServer
+                New-ADObject -Name $GUID -Type "msWMI-Som" -Path $WMIPath -OtherAttributes $OtherAttributes -Server $QueryServer
             } catch {
                 Write-Warning "New-GPOZaurrWMI - Creating GPO filter error $($_.Exception.Message). Terminating."
                 return

Public/Remove-GPOPermission.ps1

@@ -0,0 +1,29 @@
+function Remove-GPOPermission {
+    [cmdletBinding()]
+    param(
+        [validateSet('Unknown', 'NotWellKnown', 'NotWellKnownAdministrative', 'Administrative', 'NotAdministrative', 'All')][string[]] $Type,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
+        [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
+        [validateSet('Allow', 'Deny', 'All')][string] $PermitType = 'Allow',
+
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
+
+        [string[]] $ExcludePrincipal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $ExcludePrincipalType = 'Sid'
+    )
+
+    if ($Type) {
+        @{
+            Action                = 'Remove'
+            Type                  = $Type
+            IncludePermissionType = $IncludePermissionType
+            ExcludePermissionType = $ExcludePermissionType
+            PermitType            = $PermitType
+            Principal             = $Principal
+            PrincipalType         = $PrincipalType
+            ExcludePrincipal      = $ExcludePrincipal
+            ExcludePrincipalType  = $ExcludePrincipalType
+        }
+    }
+}

Public/Remove-GPOZaurr.ps1

@@ -35,12 +35,13 @@
                             Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
                             $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
                             $BackupInfo
+                            $BackupOK = $true
                         } catch {
                             Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
-
+                            $BackupOK = $false
                         }
                     }
-                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
+                    if (($BackupRequired -and $BackupOK) -or (-not $BackupRequired)) {
                         try {
                             Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName)"
                             Remove-GPO -Domain $_.DomainName -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer
@@ -61,11 +62,13 @@
                             Write-Verbose "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName)"
                             $BackupInfo = Backup-GPO -Guid $_.Guid -Domain $_.DomainName -Path $BackupFinalPath -ErrorAction Stop #-Server $QueryServer
                             $BackupInfo
+                            $BackupOK = $true
                         } catch {
                             Write-Warning "Remove-GPOZaurr - Backing up GPO $($_.DisplayName) from $($_.DomainName) failed: $($_.Exception.Message)"
+                            $BackupOK = $false
                         }
                     }
-                    if (($BackupRequired -and $BackupInfo) -or (-not $BackupRequired)) {
+                    if (($BackupRequired -and $BackupOK) -or (-not $BackupRequired)) {
                         try {
                             Write-Verbose "Remove-GPOZaurr - Removing GPO $($_.DisplayName) from $($_.DomainName)"
                             Remove-GPO -Domain $_.DomainName -Guid $_.Guid -ErrorAction Stop #-Server $QueryServer

Public/Remove-GPOZaurrLegacyFiles.ps1

@@ -0,0 +1,25 @@
+function Remove-GPOZaurrLegacyFiles {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    $Splat = @{
+        Forest                    = $Forest
+        IncludeDomains            = $IncludeDomains
+        ExcludeDomains            = $ExcludeDomains
+        ExtendedForestInformation = $ExtendedForestInformation
+        Verbose                   = $VerbosePreference
+    }
+    Get-GPOZaurrLegacyFiles @Splat | Select-Object -First $LimitProcessing | ForEach-Object {
+        try {
+            Remove-Item -Path $_.FullName -ErrorAction Stop
+        } catch {
+            $ErrorMessage = $_.Exception.Message
+            Write-Warning "Remove-GPOZaurrLegacyFiles - Failed to remove file $($_.FullName): $($ErrorMessage)."
+        }
+    }
+}

Public/Remove-GPOZaurrOrphanedSysvolFolders.ps1

@@ -0,0 +1,13 @@
+function Remove-GPOZaurrOrphanedSysvolFolders {
+    [cmdletBinding(SupportsShouldProcess)]
+    param(
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    Get-GPOZaurrSysvol | Where-Object {
+        if ($_.Status -eq 'Orphaned GPO') {
+            $_
+        }
+    } | Select-Object | Select-Object -First $LimitProcessing | ForEach-Object {
+        Remove-Item -Recurse -Force -LiteralPath $_.Path
+    }
+}

Public/Remove-GPOZaurrPermission.ps1

@@ -1,5 +1,5 @@
 function Remove-GPOZaurrPermission {
-    [cmdletBinding(SupportsShouldProcess)]
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Global')]
     param(
         [Parameter(ParameterSetName = 'GPOName', Mandatory)]
         [string] $GPOName,
@@ -7,17 +7,16 @@
         [Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
         [alias('GUID', 'GPOID')][string] $GPOGuid,
 
-        [Parameter(ParameterSetName = 'GPOGUID', Mandatory)]
-        [validateset('Unknown', 'Named')][string[]] $Type,
+        [string[]] $Principal,
+        [validateset('DistinguishedName', 'Name', 'Sid')][string] $PrincipalType = 'Sid',
 
+        [validateset('Unknown', 'NotAdministrative', 'Default')][string[]] $Type = 'Default',
 
-        [Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
+        [alias('PermissionType')][Microsoft.GroupPolicy.GPPermissionType[]] $IncludePermissionType,
         [Microsoft.GroupPolicy.GPPermissionType[]] $ExcludePermissionType,
         [switch] $SkipWellKnown,
         [switch] $SkipAdministrative,
 
-        [string[]]$NamedObjects,
-
         [alias('ForestName')][string] $Forest,
         [string[]] $ExcludeDomains,
         [alias('Domain', 'Domains')][string[]] $IncludeDomains,
@@ -27,20 +26,95 @@
     )
     Begin {
         $Count = 0
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ForestInformation
+        if ($Type -eq 'Unknown') {
+            if ($SkipAdministrative -or $SkipWellKnown) {
+                Write-Warning "Remove-GPOZaurrPermission - Using SkipAdministrative or SkipWellKnown while looking for Unknown doesn't make sense as only Unknown will be displayed."
+            }
+        }
     }
     Process {
-        if ($Type -contains 'Named' -and $NamedObjects.Count -eq 0) {
+        if ($Type -contains 'Named' -and $Principal.Count -eq 0) {
             Write-Warning "Remove-GPOZaurrPermission - When using type Named you need to provide names to remove. Terminating."
             return
         }
-        Get-GPOZaurrPermission -IncludeGPOObject -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -ExcludePermissionType $ExcludePermissionType -IncludePermissionType $IncludePermissionType -SkipWellKnown:$SkipWellKnown.IsPresent -SkipAdministrative:$SkipAdministrative.IsPresent | ForEach-Object -Process {
+        # $GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
+        #void RemoveTrustee(string trustee)
+        #void RemoveTrustee(System.Security.Principal.IdentityReference identity)
+        #$GPOPermission.GPOSecurity.Remove
+        #void RemoveAt(int index)
+        #void IList[GPPermission].RemoveAt(int index)
+        #void IList.RemoveAt(int index)
+
+        foreach ($Domain in $ForestInformation.Domains) {
+            $QueryServer = $ForestInformation['QueryServers'][$Domain]['HostName'][0]
+            if ($GPOName) {
+                $getGPOSplat = @{
+                    Name        = $GPOName
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } elseif ($GPOGuid) {
+                $getGPOSplat = @{
+                    Guid        = $GPOGuid
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            } else {
+                $getGPOSplat = @{
+                    All         = $true
+                    Domain      = $Domain
+                    Server      = $QueryServer
+                    ErrorAction = 'SilentlyContinue'
+                }
+            }
+            Get-GPO @getGPOSplat | ForEach-Object -Process {
+                $getPrivPermissionSplat = @{
+                    Principal              = $Principal
+                    PrincipalType          = $PrincipalType
+                    Accounts               = $Accounts
+                    Type                   = $Type
+                    GPO                    = $_
+                    SkipWellKnown          = $SkipWellKnown.IsPresent
+                    SkipAdministrative     = $SkipAdministrative.IsPresent
+                    IncludeOwner           = $false
+                    IncludeGPOObject       = $true
+                    IncludePermissionType  = $IncludePermissionType
+                    ExcludePermissionType  = $ExcludePermissionType
+                    ADAdministrativeGroups = $ADAdministrativeGroups
+                }
+                [Array] $GPOPermissions = Get-PrivPermission @getPrivPermissionSplat
+                if ($GPOPermissions.Count -gt 0) {
+                    foreach ($Permission in $GPOPermissions) {
+                        Remove-PrivPermission -Principal $Permission.Sid -PrincipalType Sid -GPOPermission $Permission -IncludePermissionType $Permission.Permission #-IncludeDomains $GPO.DomainName
+                    }
+                    $Count++
+                    if ($Count -eq $LimitProcessing) {
+                        # skipping skips per removed permission not per gpo.
+                        break
+                    }
+                }
+            }
+        }
+        <#
+        Get-GPOZaurrPermission @Splat | ForEach-Object -Process {
             $GPOPermission = $_
             if ($Type -contains 'Unknown') {
                 if ($GPOPermission.SidType -eq 'Unknown') {
                     #Write-Verbose "Remove-GPOZaurrPermission - Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)"
                     if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, "Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)")) {
-                        $GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
-                        $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                        try {
+                            Write-Verbose "Remove-GPOZaurrPermission - Removing permission $($GPOPermission.Permission) for $($GPOPermission.Sid)"
+                            $GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
+                            $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                            #$GPOPermission.GPOSecurity.RemoveAt($GPOPermission.GPOSecurityPermissionItem)
+                            #$GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
+                        } catch {
+                            Write-Warning "Remove-GPOZaurrPermission - Removing permission $($GPOPermission.Permission) for $($GPOPermission.Sid) with error: $($_.Exception.Message)"
+                        }
                         # Set-GPPPermission doesn't work on Unknown Accounts
                     }
                     $Count++
@@ -52,26 +126,18 @@
             }
             if ($Type -contains 'Named') {
 
-                if ($Named -contains $GPOPermission.Sid) {
-                    #Write-Verbose "Remove-GPOZaurrPermission - Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)"
-                    if ($PSCmdlet.ShouldProcess($GPOPermission.DisplayName, "Removing $($GPOPermission.Sid) from $($GPOPermission.DisplayName) at $($GPOPermission.DomainName)")) {
-                        $GPOPermission.GPOSecurity.RemoveTrustee($GPOPermission.Sid)
-                        $GPOPermission.GPOObject.SetSecurityInfo($GPOPermission.GPOSecurity)
-                        # Set-GPPPermission doesn't work on Unknown Accounts
-                    }
-                    $Count++
-                    if ($Count -eq $LimitProcessing) {
-                        # skipping skips per removed permission not per gpo.
-                        break
-                    }
-                }
+            }
+            if ($Type -contains 'NotAdministrative') {
+
+            }
+            if ($Type -contains 'Default') {
+                Remove-PrivPermission -Principal $Principal -PrincipalType $PrincipalType -GPOPermission $GPOPermission -IncludePermissionType $IncludePermissionType
             }
             #Set-GPPermission -PermissionLevel None -TargetName $GPOPermission.Sid -Verbose -DomainName $GPOPermission.DomainName -Guid $GPOPermission.GUID #-WhatIf
             #Set-GPPermission -PermissionLevel GpoRead -TargetName 'Authenticated Users' -TargetType Group -Verbose -DomainName $Domain -Guid $_.GUID -WhatIf
 
         }
+        #>
     }
-    End {
-
-    }
+    End {}
 }

Public/Repair-GPOZaurrPermissionConsistency.ps1

@@ -0,0 +1,44 @@
+function Repair-GPOZaurrPermissionConsistency {
+    [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Default')]
+    param(
+        [Parameter(ParameterSetName = 'GPOName')][string] $GPOName,
+        [Parameter(ParameterSetName = 'GPOGUID')][alias('GUID', 'GPOID')][string] $GPOGuid,
+
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation,
+
+        [int] $LimitProcessing = [int32]::MaxValue
+    )
+    $ConsistencySplat = @{
+        Forest                    = $Forest
+        IncludeDomains            = $IncludeDomains
+        ExcludeDomains            = $ExcludeDomains
+        ExtendedForestInformation = $ExtendedForestInformation
+        Verbose                   = $VerbosePreference
+    }
+    if ($GPOName) {
+        $ConsistencySplat['GPOName'] = $GPOName
+    } elseif ($GPOGuid) {
+        $ConsistencySplat['GPOGuid'] = $GPOGUiD
+    } else {
+        $ConsistencySplat['Type'] = 'Inconsistent'
+    }
+
+    Get-GPOZaurrPermissionConsistency @ConsistencySplat -IncludeGPOObject | Where-Object {
+        if ($_.ACLConsistent -eq $false) {
+            $_
+        }
+    } | Select-Object -First $LimitProcessing | ForEach-Object {
+        #Write-Verbose "Repair-GPOZaurrPermissionConsistency - Repairing GPO consistency $($_.DisplayName) from domain: $($_.DomainName)"
+        if ($PSCmdlet.ShouldProcess($_.DisplayName, "Reparing GPO permissions consistency in domain $($_.DomainName)")) {
+            try {
+                $_.IncludeGPOObject.MakeAclConsistent()
+            } catch {
+                $ErrorMessage = $_.Exception.Message
+                Write-Warning "Repair-GPOZaurrPermissionConsistency - Failed to set consistency: $($ErrorMessage)."
+            }
+        }
+    }
+}

Public/Set-GPOOwner.ps1

@@ -0,0 +1,22 @@
+function Set-GPOOwner {
+    [cmdletBinding()]
+    param(
+        [validateset('Administrative', 'Default')][string] $Type = 'Default',
+        [string] $Principal
+    )
+    if ($Type -eq 'Default') {
+        if ($Principal) {
+            @{
+                Action    = 'Owner'
+                Type      = 'Default'
+                Principal = $Principal
+            }
+        }
+    } elseif ($Type -eq 'Administrative') {
+        @{
+            Action    = 'Owner'
+            Type      = 'Administrative'
+            Principal = ''
+        }
+    }
+}

Public/Set-GPOZaurrOwner.ps1

@@ -1,8 +1,53 @@
 function Set-GPOZaurrOwner {
+    <#
+    .SYNOPSIS
+    Short description
+
+    .DESCRIPTION
+    Long description
+
+    .PARAMETER Type
+    Unknown - finds unknown Owners and sets them to Administrative (Domain Admins) or chosen principal
+    NotMatching - find administrative groups only and if sysvol and gpo doesn't match - replace with chosen principal or Domain Admins if not specified
+    NotAdministrative - combination of Unknown/NotMatching and NotAdministrative - replace with chosen principal or Domain Admins if not specified
+    All - if Owner is known it checks if it's Administrative, if it sn't it fixes that. If owner is unknown it fixes it
+    .PARAMETER GPOName
+    Parameter description
+
+    .PARAMETER GPOGuid
+    Parameter description
+
+    .PARAMETER Forest
+    Parameter description
+
+    .PARAMETER ExcludeDomains
+    Parameter description
+
+    .PARAMETER IncludeDomains
+    Parameter description
+
+    .PARAMETER ExtendedForestInformation
+    Parameter description
+
+    .PARAMETER Principal
+    Parameter description
+
+    .PARAMETER SkipSysvol
+    Parameter description
+
+    .PARAMETER LimitProcessing
+    Parameter description
+
+    .EXAMPLE
+    An example
+
+    .NOTES
+    General notes
+    #>
     [cmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Type')]
     param(
         [Parameter(ParameterSetName = 'Type', Mandatory)]
-        [validateset('EmptyOrUnknown', 'NonAdministrative')][string[]] $Type,
+        [validateset('Unknown', 'NotAdministrative', 'NotMatching', 'All')][string] $Type,
 
         [Parameter(ParameterSetName = 'Named')][string] $GPOName,
         [Parameter(ParameterSetName = 'Named')][alias('GUID', 'GPOID')][string] $GPOGuid,
@@ -23,59 +68,111 @@
         [Parameter(ParameterSetName = 'Named')]
         [System.Collections.IDictionary] $ExtendedForestInformation,
 
-        [Parameter(Mandatory, ParameterSetName = 'Named')]
+        [Parameter(ParameterSetName = 'Type')]
+        [Parameter(ParameterSetName = 'Named')]
         [string] $Principal,
 
+        [switch] $SkipSysvol,
+
         [Parameter(ParameterSetName = 'Type')]
         [Parameter(ParameterSetName = 'Named')]
-        [int] $LimitProcessing
+        [int] $LimitProcessing = [int32]::MaxValue
     )
     Begin {
-        if ($Type -contains 'NonAdministrative') {
-            $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
-        }
-        $Count = 0
+        #Write-Verbose "Set-GPOZaurrOwner - Getting ADAdministrativeGroups"
+        $ADAdministrativeGroups = Get-ADADministrativeGroups -Type DomainAdmins, EnterpriseAdmins -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation
+        #Write-Verbose "Set-GPOZaurrOwner - Processing GPO for Type $Type"
     }
     Process {
-        if ($Type) {
-            Get-GPOZaurr -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Verbose:$false | ForEach-Object -Process {
-                $GPO = $_
-                if ($Type -contains 'NonAdministrative') {
-                    if ($GPO.Owner) {
-                        $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($GPO.Owner)"]
-                        $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                        if ($AdministrativeGroup) {
-                            #Write-Verbose "Set-GPOZaurrOwner - Skipping GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName). Already owner $($GPO.Owner)."
-                        } else {
-                            Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) to $DefaultPrincipal"
-                            Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false
-                            $Count++
-                            if ($Count -eq $LimitProcessing) {
-                                break
-                            }
-                        }
-                    }
-                }
-                if ($Type -contains 'EmptyOrUnknown') {
-                    if ($null -eq $GPO.Owner) {
-                        $DefaultPrincipal = $ADAdministrativeGroups["$($GPO.DomainName)"]['DomainAdmins']
-                        Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner NULL/$($GPO.OwnerSID) to $DefaultPrincipal"
-                        Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal -Verbose:$false
-                        $Count++
-                        if ($Count -eq $LimitProcessing) {
-                            break
-                        }
-                    }
+        $getGPOZaurrOwnerSplat = @{
+            IncludeSysvol             = -not $SkipSysvol.IsPresent
+            Forest                    = $Forest
+            IncludeDomains            = $IncludeDomains
+            ExcludeDomains            = $ExcludeDomains
+            ExtendedForestInformation = $ExtendedForestInformation
+            ADAdministrativeGroups    = $ADAdministrativeGroups
+            Verbose                   = $VerbosePreference
+        }
+        if ($GPOName) {
+            $getGPOZaurrOwnerSplat['GPOName'] = $GPOName
+        } elseif ($GPOGuid) {
+            $getGPOZaurrOwnerSplat['GPOGuid'] = $GPOGUiD
+        }
+        Get-GPOZaurrOwner @getGPOZaurrOwnerSplat | Where-Object {
+            if ($_.Owner) {
+                $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
+            } else {
+                $AdministrativeGroup = $null
+            }
+            if (-not $SkipSysvol) {
+                if ($_.SysvolOwner) {
+                    $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
+                } else {
+                    $AdministrativeGroupSysvol = $null
                 }
             }
-        } else {
-            Get-GPOZaurr -GPOName $GPOName -GPOGuid $GPOGUiD -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Verbose:$false | ForEach-Object -Process {
-                $GPO = $_
-                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner)/$($GPO.OwnerSID) to $Principal"
-                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $Principal -Verbose:$false
-                $Count++
-                if ($Count -eq $LimitProcessing) {
-                    break
+            if ($Type -eq 'NotAdministrative') {
+                if (-not $AdministrativeGroup -or (-not $AdministrativeGroupSysvol -and -not $SkipSysvol)) {
+                    $_
+                } else {
+                    if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
+                        Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
+                        $_
+                    }
+                }
+            } elseif ($Type -eq 'Unknown') {
+                if (-not $_.Owner -or (-not $_.SysvolOwner -and -not $SkipSysvol)) {
+                    $_
+                }
+            } elseif ($Type -eq 'NotMatching') {
+                if ($SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). SysVol scanning is disabled. Skipping."
+                } else {
+                    if ($AdministrativeGroup -ne $AdministrativeGroupSysvol) {
+                        #Write-Verbose "Set-GPOZaurrOwner - Detected mismatch GPO: $($_.DisplayName) from domain: $($_.DomainName) - owner $($_.Owner) / sysvol owner $($_.SysvolOwner). Fixing required."
+                        $_
+                    }
+                }
+            } else {
+                # we run with no type, that means we need to either set it to principal or to Administrative
+                if ($_.Owner) {
+                    # we check if Principal is not set
+                    $AdministrativeGroup = $ADAdministrativeGroups['ByNetBIOS']["$($_.Owner)"]
+                    if (-not $SkipSysvol -and $_.SysvolOwner) {
+                        $AdministrativeGroupSysvol = $ADAdministrativeGroups['ByNetBIOS']["$($_.SysvolOwner)"]
+                        if (-not $AdministrativeGroup -or -not $AdministrativeGroupSysvol) {
+                            $_
+                        }
+                    } else {
+                        if (-not $AdministrativeGroup) {
+                            $_
+                        }
+                    }
+                } else {
+                    $_
+                }
+            }
+        } | Select-Object -First $LimitProcessing | ForEach-Object -Process {
+            $GPO = $_
+            if (-not $Principal) {
+                $DefaultPrincipal = $ADAdministrativeGroups["$($_.DomainName)"]['DomainAdmins']
+            } else {
+                $DefaultPrincipal = $Principal
+            }
+            if ($Action -eq 'OnlyGPO') {
+                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) (SID: $($GPO.OwnerSID)) to $DefaultPrincipal"
+                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal  -Verbose:$false -WhatIf:$WhatIfPreference
+            } elseif ($Action -eq 'OnlyFileSystem') {
+                if (-not $SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Changing Sysvol Owner GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.SysvolOwner) (SID: $($GPO.SysvolSid)) to $DefaultPrincipal"
+                    Set-FileOwner -JustPath -Path $GPO.SysvolPath -Owner $DefaultPrincipal  -Verbose:$true -WhatIf:$WhatIfPreference
+                }
+            } else {
+                Write-Verbose "Set-GPOZaurrOwner - Changing GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.Owner) (SID: $($GPO.OwnerSID)) to $DefaultPrincipal"
+                Set-ADACLOwner -ADObject $GPO.DistinguishedName -Principal $DefaultPrincipal  -Verbose:$false -WhatIf:$WhatIfPreference
+                if (-not $SkipSysvol) {
+                    Write-Verbose "Set-GPOZaurrOwner - Changing Sysvol Owner GPO: $($GPO.DisplayName) from domain: $($GPO.DomainName) from owner $($GPO.SysvolOwner) (SID: $($GPO.SysvolSid)) to $DefaultPrincipal"
+                    Set-FileOwner -JustPath -Path $GPO.SysvolPath -Owner $DefaultPrincipal -Verbose:$true -WhatIf:$WhatIfPreference
                 }
             }
         }

Public/Set-GPOZaurrWMI.ps1

@@ -1,6 +0,0 @@
-function Set-GPOZaurrWMI {
-    [cmdletBinding()]
-    param(
-
-    )
-}

README.md

@@ -39,5 +39,27 @@ That's it. Whenever there's a new version, you run the command, and you can enjo
 
 ## Changelog
 
-- 0.0.1 - Unreleased
+- 0.0.44 - 24.06.2020
+  - Improvement to `Get-GPOZaurrLinkSummary`
+- 0.0.43 - 21.06.2020
+  - Added `Get-GPOZaurrFiles` to list files on NETLOGON/SYSVOL shares with a lot of details
+- 0.0.42 - 19.06.2020
+  - Fix for `Get-GPOZaurrLink` and `SearchBase` parameter
+  - Fix for `Get-GPOZaurrLink` - canonical link Trim() throwing errors if empty
+- 0.0.41 - 18.06.2020
+  - Added paramerter `SkipDuplicates` to `Invoke-GPOZaurrPermission` which prevents applying permissions over and over again if 1 GPO is linked to a multiple OU's within another OU
+- 0.0.40 - 18.06.2020
+  - Fix for error `Get-GPOZaurrLink` - same issue as described on my [earlier blog - Get-ADObject : The server has returned the following error: invalid enumeration context.](https://evotec.xyz/get-adobject-the-server-has-returned-the-following-error-invalid-enumeration-context/).
+    - `WARNING: Get-GPOZaurrLink - Processing error The server has returned the following error: invalid enumeration context.`
+    - `WARNING: Get-GPOZaurrLink - Processing error A referral was returned from the server`
+  - Added `SkipDuplicates` for `Get-GPOZaurrLink`
+- 0.0.39 - 17.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameter `LimitAdministrativeGroupsToDomain`
+    - This will get administrative based on IncludeDomains if given. It means that if GPO has Domain admins added from multiple domains it will only find one, and remove all other Domain Admins (if working with Domain Admins that is)
+- 0.0.38 - 17.06.2020
+  - Update to Get-PrivGPOZaurrLink which would cause problems to `Invoke-GPOZaurrPermission` if it would be run without Administrative permission and GPO wouldn't be accessible for that user
+- 0.0.37 - 16.06.2020
+  - Updates to `Invoke-GPOZaurrPermission` with new parameterset `Level`
+  - Updates to `Get-GPOZaurrLinkSummary`
+- 0.0.36 - 15.06.2020
   - Initial release